Custom Traceroute Against Open Port hping2 -t 5 --traceroute -p 25 -S mx.chi.foocorp.com [ combined with results from hping2 -i 1 --ttl * -p 25 -S 216.163.143.2 ] 5->TTL 0 during transit from 64.159.2.97 (ae0-54.mp2.SanJose1.Level3.net) 6->TTL 0 during transit from 64.159.1.34 (so-3-0-0.mp2.Chicago1.Level3.net) 7->TTL 0 during transit from 200.247.10.170 (pos9-0.core1.Chicago1.level3.net) 8->TTL 0 during transit from 200.244.8.42 (gige6-0.ipcolo1.Chicago1.Level3.net) 9->TTL 0 during transit from 166.90.73.205 (ge1-0.br1.ord.foocorp.net) 10->TTL 0 during transit from 200.247.228.247 (f0-0.b1.chi.foocorp.com) 11->No response 12->TTL 0 during transit from 216.163.143.130 (fw.chi.foocorp.com) 13->46 bytes from 216.163.143.2: flags=SA seq=0 ttl=52 id=48957 rtt=75.8 ms Much better! Reached target machine at hop 13. Helpful naming of mx.chi and fw.chi.