Skip to main content

Traceroute

Traceroute is a network diagnostic tool used for tracking the pathway taken by a packet across an IP network from source to destination. It helps in identifying the route and measuring transit delays of packets across an Internet Protocol (IP) network.

How Traceroute Works​

  1. Packet Sending: Traceroute sends out a sequence of packets using the User Datagram Protocol (UDP) or Internet Control Message Protocol (ICMP).

  2. Time-To-Live (TTL) Values: Each packet is assigned a TTL value, which is the number of hops (routers or intermediate devices) that packet can traverse before it is discarded. The TTL value starts with 1 and increases with each step in the trace.

  3. Route Discovery: As each packet is forwarded by a router along the path to its destination, the router decrements the packet's TTL. When a packet's TTL reaches zero, the router discards the packet and sends an ICMP "Time Exceeded" message back to the source.

  4. Recording Intermediates: Each time an ICMP message is received, the source of that message (the router that discarded the packet) is recorded by traceroute. This identifies the routers or hops that the packet traversed.

  5. Identifying the Path: By incrementing the TTL and repeating the process, traceroute builds up a list of routers that the packets traverse en route to the destination.

  6. Round-Trip Time (RTT): Traceroute measures the time taken for each hop to respond, giving insight into the latency or delay on the network.

Differences in Implementations​

Unix/Linux Systems:

  • Protocol Used: Usually uses UDP.
  • Port Numbers: Sends packets to unlikely UDP ports.
  • Response: Expects ICMP "Time Exceeded" messages from intermediary routers and an ICMP "Port Unreachable" message from the target host (indicating arrival).

Windows Systems:

  • Protocol Used: Uses ICMP.
  • Packet Type: Sends ICMP Echo Request messages.
  • Response: Expects ICMP "Time Exceeded" messages from intermediary routers and an ICMP Echo Reply from the target host.

Key Differences​

  1. Protocol: Unix/Linux uses UDP, while Windows uses ICMP.
  2. Port Number: Unix/Linux implementations select high, unused UDP port numbers, while Windows does not require this as it uses ICMP Echo requests.
  3. Final Destination Response: Unix/Linux systems look for an ICMP "Port Unreachable" message (indicating that the packet reached its destination), whereas Windows looks for an ICMP Echo Reply.

Conclusion​

Understanding these differences is crucial for network engineers and administrators, especially when interpreting traceroute results in different environments. Each implementation has its nuances, but the core purpose remains the same: to map the network path and diagnose potential issues.