traceroute

A tool that maps the routers on a path by sending probes with rising TTLs and reading the Time Exceeded errors they provoke.

It turns a rule every router follows into a map: a router that reduces a packet's TTL to zero discards it and tells the source. It shows where along a path the answers stop, and its output is easy to over-read.

The probes start with TTL 1 and rise by one, three per hop by default, up to 30 hops. Linux traceroute sends UDP datagrams to port 33434 and upward, ICMP Echo with -I and TCP SYN with -T; Windows tracert always uses ICMP Echo. The trace ends at a Port Unreachable, an Echo Reply or a TCP answer from the destination.

An asterisk means no answer within the wait: a router that does not send Time Exceeded, ICMP rate limiting, or a filter dropping the probe. A trace that stops in asterisks at a firewall says nothing about the hosts behind it, and silent hops followed by answering ones are a quiet middle, not an end. A TCP trace that arrives impossibly early can be a proxy answering for the destination.

The address on each line is the source of the error, which RFC 1812 says must belong to the interface the error is sent from; with an asymmetric return path, parallel links or ECMP that is not the interface the probe came in on, as RFC 5837 explains. The return path is never traced. traceroute -e prints ICMP extensions, which can identify the incoming interface where routers send them.

Also known as: tracert, tracepath, traceroute6, trace route

Sources

← All glossary entries