(ab)using classic tools to play games

07.12.2016 (with later edits)

It is fun to abuse classic command line tools to do something that was not intended. There is famous telnet towel.blinkenlights.nl, and sometime ago there was traceroute abused to display opening text of Star Wars. But displaying static data is just boring. I wanted something interactive.


Telnet is by design two-directional, so using it to play some games wasn’t too difficult. I’ve made telnet-games, C# program that acts as telnet server and serves clients some games (pong, tetris and breakout). Pong even have multiplayer, and tetris have highscores.

screenshot screenshot

After I made that I have found that idea isn’t new and somebody made tetris on telnet before.


traceroute tool sends packets with incrementing “hop limit” values. Each device on the way to target host decrements HL, and if it is 0 then it sends ICMP Time Exceeded message back to source host, which allows traceroute to discover path to target host. So, how it could be used to display arbitrary text, without even controlling some interactive games? traceroute is that nice that along with IPs of devices that sent ICMP reply, it also by default shows reverse DNS lookup of it. If we have sufficient amount of IP addresses on what we have control of PTR records, we can essentialy display any arbitrary text. That was used by beaglenetworks Star Wars intro, though his setup consisted of two routers really exchanging packets by some convoluted routes. That isn’t necessary because we can capture packets with low TTL and spoof ICMP TE replies on normal Linux system. Of course, amount of IPs needed to implement tetris rendering in PTR records in pretty big (2^20) (tetris have 10 columns, and we want to distingush between active and freezed blocks). For that reason I’ve used IPv6 for my tetris. That leaves us with last problem, how to control interactive game with traceroute? It is possible to encode moves in subdomain of game address. It will be then resolved to moves encoded in IP address. Traceroute will try to find path to that IP, and on first request with new moves sequence application can apply moves and do game tick.


Quickly hacked implementation of this idea is available at trh.milek7.pl. Recommended traceroute command is (IPv6 required)

traceroute -I -m 60 -q 1 trh.milek7.pl

For unknown reasons UDP (default) method don’t work well, HL values that comes at server are duplicated, out of order and skipped. Thus it is required to play with -I switch to enable ICMP probes.

To control game you need to append commands to that subdomain:

Commands can be stacked, so for example tracerouting to wwddds.trh.milek7.pl: rotates 2x, moves right 3x and drops piece. After piece is dropped to request new piece you need to traceroute trh.milek7.pl once without commands.

Have fun!