Related: you can "traceroute" a specific port, TCP or UDP. Different routes for different ports is a sure sign of tampering. Check the man page for syntax.