In computing, traceroute is a computer network diagnostic tool for displaying the route and
measuring transit delays of packets across an Internet Protocol network. The history
of the route is recorded as the round-trip times of the packets received from each successive
host in the route; the sum of the mean times in each hop indicates the total time spent
to establish the connection. Traceroute proceeds unless all sent packets are lost more than
twice, then the connection is lost and the route cannot be evaluated. Ping, on the other
hand, only computes the final round-trip times from the destination point.
The traceroute command is available on a number of modern operating systems. On Apple Mac
OS, it is available by opening 'Network Utilities' then selecting 'Traceroute' tab, as well as
by typing the "traceroute" command in the terminal. On other Unix systems, such as FreeBSD
or Linux, it is available as a traceroute(8) command in a terminal. On Microsoft Windows,
it is named tracert. Windows NT-based operating systems also provide PathPing, with similar
functionality. For Internet Protocol Version 6 the tool sometimes has the name traceroute6
or tracert6.
Implementation
Traceroute, by default, sends a sequence of User Datagram Protocol packets addressed to
a destination host; ICMP Echo Request or TCP SYN packets can also be used. The time-to-live
value, also known as hop limit, is used in determining the intermediate routers being
traversed towards the destination. Routers decrement packets' TTL value by 1 when routing
and discard packets whose TTL value has reached zero, returning the ICMP error message ICMP
Time Exceeded. Common default values for TTL are 128 and 64.
Traceroute works by sending packets with gradually increasing TTL value, starting with TTL value
of 1. The first router receives the packet, decrements the TTL value and drops the packet
because it then has TTL value zero. The router sends an ICMP Time Exceeded message back to
the source. The next set of packets are given a TTL value of 2, so the first router forwards
the packets, but the second router drops them and replies with ICMP Time Exceeded. Proceeding
in this way, traceroute uses the returned ICMP Time Exceeded messages to build a list
of routers that packets traverse, until the destination is reached and returns an ICMP
Echo Reply message. The timestamp values returned for each router
along the path are the delay values, typically measured in milliseconds for each packet.
Hop 192.168.1.2 Depth 1 Probe status: unsuccessful
Parent: Return code: Label-switched at stack-depth
1 Sender timestamp: 2008-04-17 09:35:27 EDT
400.88 msec Receiver timestamp: 2008-04-17 09:35:27 EDT
427.87 msec Response time: 26.92 msec
MTU: Unknown Multipath type: IP
Address Range 1: 127.0.0.64 ~ 127.0.0.127 Label Stack:
Label 1 Value 299792 Protocol RSVP-TE
The sender expects a reply within a specified number of seconds. If a packet is not acknowledged
within the expected interval, an asterisk is displayed. The Internet Protocol does not
require packets to take the same route towards a particular destination, thus hosts listed
might be hosts that other packets have traversed. If the host at hop #N does not reply, the
hop is skipped in the output. On Unix-like operating systems, the traceroute
utility uses User Datagram Protocol datagrams by default, with destination port numbers
ranging from 33434 to 33534. The traceroute utility usually has an option to instead use
ICMP Echo Request packets, like the Windows tracert utility does, or to use TCP SYN packets.
If a network has a firewall and operates both Windows and Unix-like systems, more than one
protocol must be enabled inbound through the firewall for traceroute to work and receive
replies. Some traceroute implementations use TCP packets,
such as tcptraceroute or layer four traceroute. PathPing is a utility introduced with Windows
NT that combines ping and traceroute functionality. MTR is an enhanced version of ICMP traceroute
available for Unix-like and Windows systems. The various implementations of traceroute
all rely on ICMP Time Exceeded packets being sent to the source.
The implementations of traceroute shipped with Linux, FreeBSD, NetBSD, OpenBSD, DragonFly
BSD, and Mac OS X include an option to use ICMP Echo packets, or any arbitrary protocol
such as UDP, TCP or ICMP. Cisco's implementation of traceroute also
uses a sequence of UDP datagrams, each with incrementing TTL values, to an invalid port
number at the remote host; by default, UDP port 33434 is used. Extended version of this
command can change the destination port number used by the UDP probe messages.
Usage Most implementations include at least options
to specify the number of queries to send per hop, time to wait for a response, the hop
limit and port to use. Invoking traceroute with no specified options displays the list
of available options, while man traceroute presents more details, including the displayed
error flags. Simple example on Linux:
In the example above, selected options are to wait for three seconds, send out only one
query to each hop, limit the maximum number of hops to 16 before giving up, with example.com
as the final host. This can help identify incorrect routing table
definitions or firewalls that may be blocking ICMP traffic, or high port UDP in Unix ping,
to a site. Note that a firewall may permit ICMP packets but not permit packets of other
protocols. Traceroute is also used by penetration testers
to gather information about network infrastructure and IP ranges around a given host.
It can also be used when downloading data, and if there are multiple mirrors available
for the same piece of data, one can trace each mirror to get a good idea of which mirror
would be the fastest to use. Origins
The traceroute manual page states that the original traceroute program was written by
Van Jacobson in 1987 from a suggestion by Steve Deering, with particularly cogent suggestions
or fixes from C. Philip Wood, Tim Seaver and Ken Adelman. Also, the inventor of the ping
program, Mike Muuss, states on his website that traceroute was written using kernel ICMP
support that he had earlier coded to enable raw ICMP sockets when he first wrote the ping
program. See also
References
External links RFC 1393: Traceroute using an IP Option Internet
RFC How traceroute works – InetDaemon
traceroute.org Online traceroute services. Tracert – Windows XP Command-line reference
This article is based on material taken from the Free On-line Dictionary of Computing prior
to 1 November 2008 and incorporated under the "relicensing" terms of the GFDL, version
1.3 or later.