xmtr is a Rust network diagnostics tool that traces multiple targets in parallel over IPv4/IPv6 using trippy, then visualizes each route on IPMap for authorized diagnostic work.
| Tool | Alice39s/xmtr — parallel multi-target traceroute front end built on trippy with route upload to IPMap |
| Category | network diagnostics and route mapping (Rust CLI) |
| Primary Use | Running parallel traceroute-style diagnostics against several targets over IPv4/IPv6 with ICMP, TCP or UDP probes, in authorized network assessment and troubleshooting workflows |
| Safe Use | Intended for administrators and authorized professionals diagnosing networks they own or are contracted to assess, in labs, enterprise troubleshooting, and defensive path analysis |
| Telemetry Note | Generates normal ICMP/TCP/UDP probe traffic to each target, leaving traces identical to conventional traceroute/mtr in flow logs; uploads route data to xmsl.dev IPMap unless --no-upload or --json is used |
xmtr attacks a specific frustration every network operator knows: classic traceroute and mtr are fundamentally single-target tools, and comparing paths to several destinations means juggling multiple terminals and eyeballing the output side by side. Written in Rust and licensed under MIT OR Apache-2.0, xmtr wraps the mature trippy tracing engine to probe several targets concurrently, decides on its own when each route is stable enough to stop, and then uploads the collected routes to xmsl.dev IPMap, which plots every hop geographically and can replay the route. The result is a tool that turns a scatter of textual hop lists into a comparative, visual artifact in one command.
The core invocation is deliberately minimal: sudo xmtr 1.1.1.1 cloudflare.com traces both targets at once, over IPv4 and IPv6 when the host has both stacks, printing the routes plus a map link at the end. Under the hood the five-step pipeline begins with resolving every target, then fans out probes through trippy's engine. The README documents that a run stops each individual route once its path is stable rather than waiting for all targets to finish, which is a smart design choice — a slow or filtering path never blocks the report for the healthy ones.
Probe flexibility matters in real diagnostics, and xmtr exposes it cleanly. xmtr -p tcp --port 443 example.com forces TCP probes against a specific port, which is exactly what you want when ICMP is deprioritized or rate-limited along the path and you need to see what a TCP-speaking application actually experiences. xmtr -4 --min-rounds 20 example.com pins the trace to IPv4 and demands at least twenty rounds before declaring the route stable, giving you statistically meaningful latency and loss figures per hop instead of a single-pass snapshot. Both ICMP and UDP modes exist alongside TCP, mirroring trippy's capabilities.
The privacy- and data-handling story deserves attention from professional users. By default the tool uploads traced routes to the third-party IPMap service to produce the shareable visualization. The authors clearly anticipated objections: --no-upload prints routes without uploading anything, --json emits the upload payload as local JSON with tables on stderr, and --pin 2580 lets you gate map access behind a viewer-entered PIN. For engagement documentation where hop data about a client's infrastructure should not leave your machine, --no-upload combined with --json output is the correct posture; the map link feature is better reserved for lab work or public targets like 1.1.1.1.
Installation coverage is unusually thorough for a young project. Beyond the POSIX sh install script for macOS, Linux, FreeBSD and Termux, and a PowerShell counterpart for Windows, the binaries ship through Homebrew, Scoop, WinGet, Chocolatey, npm (@xmtr/cli), PyPI, cargo binstall, mise, Nix, and Docker (ghcr.io/alice39s/xmtr). Native deb, rpm and apk repositories are signed with keys from packaging/keys, and those Linux packages grant raw socket capability via setcap at install time so unprivileged users can trace without root — a thoughtful touch that removes the most common operational friction. The npm and PyPI packages are wrappers around the same release binaries, not rewrites.
That privilege question is handled honestly in the README's Privileges section. Tracing needs raw sockets: on Linux that means root or a one-time sudo setcap cap_net_raw+ep $(command -v xmtr); on macOS any user can run ICMP and UDP traces via unprivileged sockets while TCP probes need root; Windows requires an Administrator terminal; FreeBSD and Android require root. One sharp edge is documented: xmtr self update replaces the binary, which drops the setcap bit, so capability must be re-applied after updates. Operators running this on hardened assessment laptops should script that step.
The update mechanism itself is well-reasoned from a trust standpoint. After an interactive terminal run, xmtr checks for a newer release with a three-second timeout and offers to install and re-run; when a package manager owns the binary it instead prints the correct update command rather than clobbering the install. Non-interactive modes (--json, --quiet, --no-upload) and runs without a terminal skip the lookup entirely. Releases are immutable, and downloads can be verified two ways: gh release verify-asset confirms a file belongs to a release tag, and gh attestation verify checks build provenance through the repository's attestations — supply-chain hygiene that security professionals should appreciate and expect.
Platform breadth is genuinely wide. Builds cover Linux on glibc and musl across x86_64 through riscv64 and loongarch64, macOS on Apple silicon and Intel, Windows 10+, FreeBSD, and Android via Termux with root; the Docker image is a static binary spanning amd64, arm64, armv7, armv6, 386, riscv64 and loong64. Just as telling is the README's candid table of what is not supported and why — NetBSD, OpenBSD, DragonFly BSD, illumos and Solaris fail because trippy's socket layer does not compile there or Rust lacks prebuilt cross-compilation standard libraries, and iOS/WebAssembly are excluded for lack of raw socket access. CI reportedly traces 127.0.0.1 with every build before release, including under QEMU, which signals real release discipline.
Within an authorized workflow, where xmtr earns its place is comparative path analysis: verifying whether a client's multiple sites traverse the same congested transit AS, confirming failover behavior after a routing change, or documenting from a jump host which upstreams carry traffic to in-scope hosts during an assessment. Because it resolves hop ASNs and renders the route replayable, it doubles as a teaching artifact when you need to explain to a stakeholder exactly where latency or filtering is introduced — often more persuasive than a wall of mtr text. It is a diagnostics tool, not an exploitation primitive; its probes are the same packets traceroute has always sent.
From a defender's chair, xmtr is benign but observable. It produces exactly the ICMP/TCP/UDP TTL-exceeded traffic signature of conventional traceroute tools, visible in NetFlow and IDS rules tuned for reconnaissance scanning; the distinguishing behavior is fan-out across multiple targets from one process and periodic upload traffic to xmsl.dev. The XMTR_RELEASES environment variable can point installs at an http:// mirror, an option worth noting for egress-controlled environments where you would want to pin a trusted internal mirror instead. For teams writing tooling policy, the key questions are whether the default IPMap upload fits your data-handling rules and whether raw-socket capability grants are tracked.
The repository sits at 41 stars with active, recent development, Apache-2.0 licensing, bilingual English/Chinese documentation, and a README that reads like engineering documentation rather than marketing — privilege matrices, attestation verification, signed repositories, and honest platform exclusions. For anyone whose day involves asking which path, to which target, changed since yesterday, and wanting that answer in one command with a picture attached, xmtr is a compact, well-engineered addition to the diagnostics kit.
Alice39s/xmtr.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.