I want to obtain internal IP of a remote computer behind a NAT that I can reach by using some port, say
C:\>telnet myhost.farfar.away 11122 SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
As you see, there is a SSH server on it, but I don't have connections user data.
If I try to trace the route (fake IPs, of course):
C:\>tracert -d myhost.farfar.away Trace route to address myhost.farfar.away [126.96.36.199] maximum 30 hops: 1 <1 ms <1 ms <1 ms 192.168.11.1 2 <1 ms <1 ms <1 ms 192.168.10.1 3 47 ms 47 ms 47 ms 188.8.131.52 4 81 ms 86 ms 80 ms 184.108.40.206 Trace route complete.
I know that
myhost.farfar.away has IP
220.127.116.11, but is it possible to keep hoping through this NAT, now that I know
11122TCP port is redirected to this machine, in order to obtain its internal IP (bypassing the NAT)?
NOTE: I know its internal IP is
172.26.5.5, so theorically I would like to reach something like:
3 47 ms 47 ms 47 ms 18.104.22.168 4 81 ms 86 ms 80 ms 22.214.171.124 5 101 ms 106 ms 100 ms 172.26.5.5
Same results for
netstat, of course.
I have tested
tcpdump, but I think it can only give info about connections entering into my computer, so executing this line on the remote machine would do the trick:
tcpdump -i any port 11122
But can it be done on the local "scanning" computer? I can use both Windows or Linux.