Since tcpping requires tcptraceroute, I'll start with tcptraceroute.
The author of tcptraceroute states that unlike a traditional traceroute, "By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters."
Further: It is worth noting that tcptraceroute never completely establishes a TCP connection with the destination host.
So, tcptraceroute does not measure the time it takes to complete the three-way handshake because that never happens. It measures the time from the initial SYN to the SYN/ACK. This is sometimes referred to as a half-open connection scan.
From the nmap manpage:
This technique is often referred to as half-open scanning,
because you don’t open a full TCP connection. You send a SYN
packet, as if you are going to open a real connection and then
wait for a response. A SYN/ACK indicates the port is listening
(open), while a RST (reset) is indicative of a non-listener. If
no response is received after several retransmissions, the port
is marked as filtered. The port is also marked filtered if an
ICMP unreachable error (type 3, code 1,2, 3, 9, 10, or 13) is
received.
As to your packet size question, the above description also has the answer. Since tcptraceroute sends a standard SYN packet, it should be a small packet, perhaps 64 bytes.
I am not aware of any standard specification or reference implementation for "TCP Ping" or "TCP Traceroute", so you probably need to pick a particular pair of tools that implement these tests and then use a packet sniffer to see what those particular tools do.
Does it take in account just the time it takes to establis the TCP handshake?
no... your machine sends out 3 UDP packets with a TTL (Time-to-Live) of 1. When those packets reach the next hop router, it will decrease the TTL to 0 and thus reject the packet. It will send an ICMP Time-to-Live Exceeded (Type 11), TTL equal 0 during transit (Code 0) back to your machine - with a source address of itself, therefore you now know the address of the first router in the path.
Traceroute'' is a network debugging utility that attempts to trace the path a packet takes through the network.
Traceroute transmits packet with small time to live(TTL) values. At every router the value is being decremented by 1 and if TTL reaches 0 the packet has been expired and is discarded. Traceroute depends on the common router practice of sending an ICMP Time Exceeded message, documented in RFC 792, back to the sender when this occurs.
I believe you are referring to these utilities:
http://www.vdberg.org/~richard/tcpping.html
http://michael.toren.net/code/tcptraceroute/
Since tcpping requires tcptraceroute, I'll start with tcptraceroute.
The author of tcptraceroute states that unlike a traditional traceroute, "By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters."
Further: It is worth noting that tcptraceroute never completely establishes a TCP connection with the destination host.
So, tcptraceroute does not measure the time it takes to complete the three-way handshake because that never happens. It measures the time from the initial SYN to the SYN/ACK. This is sometimes referred to as a half-open connection scan.
From the nmap manpage:
As to your packet size question, the above description also has the answer. Since tcptraceroute sends a standard SYN packet, it should be a small packet, perhaps 64 bytes.
I am not aware of any standard specification or reference implementation for "TCP Ping" or "TCP Traceroute", so you probably need to pick a particular pair of tools that implement these tests and then use a packet sniffer to see what those particular tools do.
no... your machine sends out 3 UDP packets with a TTL (Time-to-Live) of 1. When those packets reach the next hop router, it will decrease the TTL to 0 and thus reject the packet. It will send an ICMP Time-to-Live Exceeded (Type 11), TTL equal 0 during transit (Code 0) back to your machine - with a source address of itself, therefore you now know the address of the first router in the path.
More info Please see http://www.tek-tips.com/faqs.cfm?fid=381
Traceroute'' is a network debugging utility that attempts to trace the path a packet takes through the network. Traceroute transmits packet with small time to live(TTL) values. At every router the value is being decremented by 1 and if TTL reaches 0 the packet has been expired and is discarded. Traceroute depends on the common router practice of sending an ICMP Time Exceeded message, documented in RFC 792, back to the sender when this occurs.