It is fun to abuse classic command line tools to do something that was not
intended. There is famous telnet towel.blinkenlights.nl, and sometime ago there was
traceroute abused to display opening text of Star Wars.
But displaying static data is just boring. I wanted something interactive.
Telnet is by design two-directional, so using it to play some games wasn’t too difficult. I’ve made telnet-games, C# program that acts as telnet server and serves clients some games (pong, tetris and breakout). Pong even have multiplayer, and tetris have highscores.
After I made that I have found that idea isn’t new and somebody made tetris on telnet before.
traceroute tool sends packets with incrementing “hop limit” values. Each device
on the way to target host decrements HL, and if it is 0 then it sends ICMP
Time Exceeded message back to source host, which allows traceroute to discover
path to target host. So, how it could be used to display arbitrary text,
without even controlling some interactive games? traceroute is that nice that
along with IPs of devices that sent ICMP reply, it also by default shows reverse DNS
lookup of it. If we have sufficient amount of IP addresses on what we have control
of PTR records, we can essentialy display any arbitrary text. That was used by beaglenetworks
Star Wars intro, though his setup consisted of two routers really exchanging packets
by some convoluted routes. That isn’t necessary because we can capture packets
with low TTL and spoof ICMP TE replies on normal Linux system. Of course, amount
of IPs needed to implement tetris rendering in PTR records in pretty big (2^20)
(tetris have 10 columns, and we want to distingush between active and freezed blocks).
For that reason I’ve used IPv6 for my tetris.
That leaves us with last problem, how to control interactive game with traceroute?
It is possible to encode moves in subdomain of game address. It will be then resolved
to moves encoded in IP address. Traceroute will try to find path to that IP, and on
first request with new moves sequence application can apply moves and do game tick.
Quickly hacked implementation of this idea is available at trh.milek7.pl.
Recommended traceroute command is (IPv6 required)
traceroute -I -m 60 -q 1 trh.milek7.pl
For unknown reasons UDP (default) method don’t work well, HL values that comes at
server are duplicated, out of order and skipped. Thus it is required to play with
-I switch to enable ICMP probes.
To control game you need to append commands to that subdomain:
Commands can be stacked, so for example tracerouting to wwddds.trh.milek7.pl: rotates 2x,
moves right 3x and drops piece. After piece is dropped to request new piece you need to
traceroute trh.milek7.pl once without commands.
Have fun!
