The probe answered.
Local socket evidence records the offender address, ICMP condition, TTL, timing, and probe count.
routeq / 0.1.0 · experimental
The internet path,
with receipts.
skbx-route turns a bounded UDP route observation into
hop dossiers: what answered, what stayed silent, what public routing
data adds, and where certainty ends.
- Probe
- Rootless UDP / IPv4
- Budget
- Hop + packet + clock bounded
- Claim
- Silence remains unknown
ROUTE / 1.1.1.1
COMPLETE
Traceroute is the opening question
A hop is not a router inventory.
A response proves that an address answered a particular probe from this vantage at this time. It does not prove every forwarding device, a physical location, ownership, or that silence means loss. The dossier keeps those distinctions intact.
Illustrative routeq record · select a TTL
A hop answers.
A dossier opens.
Every point below is inspectable. The selected hop separates the direct response from passive metadata and unresolved questions.
Swipe the plot to inspect TTL 04–05
trace:7c42… / target 1.1.1.1
5 TTLs / 1 probe each
attempted 05
replies 04
timeouts 01
local errors 00
This browser visualization uses an illustrative, documentation-safe record. It does not probe your network.
Evidence vocabulary
Certainty is a field,
not a feeling.
A public source adds context.
Opt-in RIPEstat lookups can add prefix, origin ASN, and RPKI state. They never become forwarding evidence.
A role is plausible.
“ISP edge” or “target network” may be a useful interpretation, but must retain its basis and uncertainty.
The record does not know.
A silent hop, hidden device, physical link, or router policy stays unresolved instead of becoming a story.
Plan before packets
Full send.
Hard ceiling.
plan resolves no target and sends nothing. It validates
the complete probe envelope so an operator or agent can inspect the
cost before the live command.
16 max hops
×
1 probe / hop
=
16 packet ceiling
- Per-probe timeout
- 400 ms
- Wall-clock budget
- 8,000 ms
- Transport
- One fixed UDP five-tuple
- Active service probes
- None
skbx-route plan 1.1.1.1 \
--max-hops 16 --probes 1 \
--timeout-ms 400 --max-duration-ms 8000 \
--jsonAppend-only routeq
Replay the route.
Audit the limits.
The stream begins with its plan, emits ordered hop records, and ends with attempted, sent, reply, timeout, and local-error counters. A missing or inconsistent footer is invalid—not “close enough.”
01"type": "trace_start", "planned_packets": 16
02"ttl": 1, "evidence": "observed"
03"ttl": 3, "responder": null
04"ttl": 5, "destination_reached": true
Visibility boundary
Across the internet.
Inside only what you own.
Kernel hooks, SKB lineage, interfaces, drops, and a replayable traceq artifact.
skbx-route
hop responses + explicit silence
If you control it, add a sensor. Arc may correlate the two artifacts; it does not invent the transit path.
01 No port scanning or service enumeration of intermediate responders.
02 A responder address is not proof of every forwarding device.
03 Reverse DNS, ASN, RPKI, and geography are metadata—not direct transit evidence.
04 Public responder enrichment is opt-in and sends those addresses to RIPEstat.
Start with an inspectable plan.
Build your first dossier.
$ cargo install --git https://github.com/copyleftdev/skbx --locked skbx-route