本节书摘来自异步社区《Nmap渗透测试指南》一书中的第2章2.15节路由跟踪，作者 商广明,更多章节内容可以访问云栖社区“异步社区”公众号查看。

2.15　路由跟踪

使用--traceroute选项即可进行路由跟踪，使用路由跟踪功能可以帮助用户了解网络的同行情况，通过此选项可以轻松地查出从本地计算机到目标之间所经过的网络节点，并可以看到通过各个节点的时间。

root@Wing:~# nmap --traceroute -v www.163.comStarting Nmap 6.47 ( http://nmap.org ) at 2015-06-27 21:04 CSTInitiating Ping Scan at 21:04Scanning www.163.com (112.253.19.198) [4 ports]　　#此处解析出网易服务器地址Completed Ping Scan at 21:04, 0.00s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 21:04Completed Parallel DNS resolution of 1 host. at 21:04, 0.02s elapsedInitiating SYN Stealth Scan at 21:04Scanning www.163.com (112.253.19.198) [1000 ports]Discovered open port 80/tcp on 112.253.19.198Discovered open port 8080/tcp on 112.253.19.198Discovered open port 443/tcp on 112.253.19.198Discovered open port 8888/tcp on 112.253.19.198Discovered open port 88/tcp on 112.253.19.198Discovered open port 3000/tcp on 112.253.19.198Discovered open port 9080/tcp on 112.253.19.198Discovered open port 8085/tcp on 112.253.19.198adjust_timeouts2: packet supposedly had rtt of 9022009 microseconds.　Ignoring time.adjust_timeouts2: packet supposedly had rtt of 9022009 microseconds.　Ignoring time.Discovered open port 8383/tcp on 112.253.19.198SYN Stealth Scan Timing: About 30.05% done; ETC: 21:05 (0:01:12 remaining)Discovered open port 7001/tcp on 112.253.19.198Discovered open port 8088/tcp on 112.253.19.198Discovered open port 3030/tcp on 112.253.19.198SYN Stealth Scan Timing: About 62.28% done; ETC: 21:05 (0:00:37 remaining)Discovered open port 8082/tcp on 112.253.19.198Discovered open port 20000/tcp on 112.253.19.198RTTVAR has grown to over 2.3 seconds, decreasing to 2.0RTTVAR has grown to over 2.3 seconds, decreasing to 2.0RTTVAR has grown to over 2.3 seconds, decreasing to 2.0RTTVAR has grown to over 2.3 seconds, decreasing to 2.0Completed SYN Stealth Scan at 21:06, 114.52s elapsed (1000 total ports)Initiating Traceroute at 21:06RTTVAR has grown to over 2.3 seconds, decreasing to 2.0RTTVAR has grown to over 2.3 seconds, decreasing to 2.0Completed Traceroute at 21:06, 0.03s elapsedInitiating Parallel DNS resolution of 2 hosts. at 21:06Completed Parallel DNS resolution of 2 hosts. at 21:06, 0.01s elapsedNmap scan report for www.163.com (112.253.19.198)Host is up (1.1s latency).Other addresses for www.163.com (not scanned): 218.58.206.54Not shown: 980 closed portsPORT　　　STATE　　 SERVICE80/tcp　　open　　　http88/tcp　　open　　　kerberos-sec135/tcp　 filtered msrpc139/tcp　 filtered netbios-ssn443/tcp　 open　　　https445/tcp　 filtered microsoft-ds514/tcp　 filtered shell593/tcp　 filtered http-rpc-epmap3000/tcp　open　　　ppp3030/tcp　open　　　arepa-cas4444/tcp　filtered krb5247001/tcp　open　　　afs3-callback8080/tcp　open　　　http-proxy8082/tcp　open　　　blackice-alerts8085/tcp　open　　　unknown8088/tcp　open　　　radan-http8383/tcp　open　　　m2mservices8888/tcp　open　　　sun-answerbook9080/tcp　open　　　glrpc20000/tcp open　　　dnpTRACEROUTE (using port 80/tcp)　　#经过网易服务器的80端口HOP RTT　　 ADDRESS1　 0.13 ms 192.168.239.22　 0.13 ms 112.253.19.198Nmap done: 1 IP address (1 host up) scanned in 114.74 seconds　　　　　 Raw packets sent: 1098 (48.240KB) | Rcvd: 1091 (43.724KB)root@Wing:~#