Traceroute

traceroute outputs the list of traversed routers in simple text format, together with timing information

traceroute is a computer network tool used to show the route taken by packets across an IP network. An IPv6 variant, traceroute6, is also widely available.

The traceroute toolsss is available on practically all Unix-like operating systems. Variants with similar functionality are also available, such as tracepath on modern Linux installations and tracert on Microsoft Windows operating systems. Windows NT-based operating systems also provide PathPing, which provides similar functionality.

Implementation

Traceroute works by increasing the "time-to-live" value of each successive batch of packets sent. The first three packets sent have a time-to-live (TTL) value of one (implying that they are not forwarded by the next router and make only a single hop). The next three packets have a TTL value of 2, and so on. When a packet passes through a host, normally the host decrements the TTL value by one, and forwards the packet to the next host. When a packet with a TTL of one reaches a host, the host discards the packet and sends an ICMP time exceeded (type 11) packet to the sender, or an echo reply (type 0) if its IP address matches the IP address that the packet was originally sent to. The traceroute utility uses these returning packets to produce a list of hosts that the packets have traversed in transit to the destination. The three timestamp values returned for each host along the path are the delay (aka latency) values typically in milliseconds (ms) for each packet in the batch.

Hop 192.168.1.2 Depth 1
    Probe status: unsuccessful
    Parent: ()
    Return code: Label-switched at stack-depth 1
    Sender timestamp: 2008-04-17 09:35:27 EDT 400.88 msec
    Receiver timestamp: 2008-04-17 09:35:27 EDT 427.87 msec
    Response time: 26.99 msec
    MTU: Unknown
    Multipath type: IP
      Address Range 1: 127.0.0.64 ~ 127.0.0.127
    Label Stack:
      Label 1 Value 299792 Protocol RSVP-TE

If a packet does not return within the expected timeout window, a star (asterisk) is traditionally printed. Traceroute may not list the real hosts. It indicates that the first host is at one hop, the second host at two hops, etc. IP does not guarantee that all the packets take the same route. Also note that if the host at hop number N does not reply, the hop will be skipped in the output.

On modern Unix-like operating systems, the traceroute utility by default uses UDP datagrams with destination ports numbering from 33434 to 33534. The traceroute utility usually has an option to specify use of ICMP echo request (type 8) instead, as used by the Windows tracert utility. If you have a firewall and if you want traceroute to work from both machines (Unix-like systems and Windows) you will need to allow both protocols inbound through your firewall (UDP with ports from 33434 to 33534 and ICMP type 8).

There are also traceroute implementations that use TCP packets, such as tcptraceroute or layer four traceroute. PathPing is a utility introduced with Windows NT that combines ping and traceroute functionality. mtr (my traceroute) is an enhanced version of ICMP traceroute which is available for Unix-like and Windows systems. All implementations of traceroute rely on ICMP (type 11) packets being sent to the originator.

The implementations of traceroute shipped with Linux, FreeBSD, NetBSD, OpenBSD, DragonFly BSD, and Mac OS X include an option to use ICMP Echo packets (-I) or any arbitrary protocol (-P) such as UDP, TCP, ICMP, or GRE.

Uses

Traceroute is often used for network troubleshooting. By showing a list of routers traversed, it allows the user to identify the path taken to reach a particular destination on the network. This can help identify routing problems or firewalls that may be blocking ICMP traffic, or high port UDP in UNIX ping, to a site. Traceroute is also used by penetration testers to gather information about network infrastructure and IP ranges around a given host. It can also be used when downloading data, and if there are multiple mirrors available for the same piece of data, one can trace each mirror to get a good idea of which mirror would be the fastest to use.

Security concerns

Supplying such detailed information about the pathways taken was considered acceptable and convenient in the early days of the Internet, but later was considered questionable for privacy and security reasons. Traceroute information has been frequently used by hackers as a way to acquire sensitive information about a company's network architecture. By using the traceroute command, a hacker can quickly map out intermediate routers for known destinations on a company's network architecture.

For these reasons, while traceroute was widely unrestricted during the early days of the Internet, today many networks block traceroute requests, or de-prioritize the ICMP time exceeded message that is required to determine round trip time. However, filtering traffic except at network end-points is a controversial practice.

Origins

The traceroute manual page states that the original traceroute program was written by Van Jacobson in 1987 from a suggestion by Steve Deering, with particularly cogent suggestions or fixes from C. Philip Wood, Tim Seaver and Ken Adelman. Also, the inventor of the ping program, Mike Muuss, states on his website, that traceroute was written using kernel ICMP support, that he had earlier coded, to enable raw ICMP sockets when he first wrote the PING program.

See also

• MTR (software) - computer software which combines the functionality of the traceroute and ping programs in a single network diagnostic tool.
• PathPing - a network utility supplied in Windows NT and beyond that combines the functionality of ping with that of traceroute (or tracert).
• List of Unix utilities
• List of DOS commands

External links

• RFC 1393: Traceroute using an IP Option Internet RFC
• RFC 792: Internet Control Message Protocol (ICMP)
• Traceroute man page for FreeBSD
• Traceroute man page for NetBSD
• Traceroute man page for OpenBSD
• TRACERT manual page on Microsoft Technet for Windows XP
• Traceroute for Linux
• Paris traceroute
• traceroute.org: monthly updated list of online traceroutes
• BGP4.net Traceroute Wiki: hundreds of traceroute servers, sorted by Autonomous System Number
• GeoTrace - Geographically map a hostname or domain with traceroute
• Graphical TraceRoute for Windows

---

This article is based on material taken from the Free On-line Dictionary of Computing prior to 1 November 2008 and incorporated under the "relicensing" terms of the GFDL, version 1.3 or later.