Another tool that makes the same use of the TCP handshake is tctrace. Much like tcptraceroute, tctrace sends a SYN packet to a specific host and if the reply is a SYN/ACK, the port is open. An RST packet indicates a closed port.
To start tctrace, enter the following command:
# tctrace -i<device> -d<targethost>
-i <device> is the network interface on the target and -d <target host> is the target.
For this example, we are going to run tctrace against the www.example.com domain:
# tctrace -i eth0 -d www.example.com
The following output is obtained:
1(1) [172.16.43.1] 2(1) [172.16.44.1] 3(all) Timeout 4(3) [172.16.46.1] 5(1) [172.16.47.1] 6(1) [172.16.48.1] 7(1) [] ... 14(1) [172.16.56.1] 15(1) [172.16.57.1] 16(1) [198.148.81.137] (reached; open)