4

I know, that traceroute uses UDP, and for destination port it starts with 33434. Then, with each next hop it increments the destination port number by 1. The questions is: why does traceroute need to increment the destination port? Wouldn't it be sufficient to just increment the TTL value, while keeping the port number unchanged, say, 33434, or any other from the allowed range?

Improve this question
2
  • 1
    "I know, that traceroute uses UDP" That actually depends on the traceroute application used. Some versions use ICMP echo, not UDP.
    – Ron Maupin ♦
    Commented Nov 2, 2017 at 14:08
  • Or even TCP. Which option you use depends on the the problem you are troubleshooting. Depending on the version of traceroute you can also use a fixed port with -U which uses port 53/udp by default and is sometimes very useful to debug DNS problems.
    – user2084
    Commented Sep 13, 2018 at 17:52

1 Answer 1

Reset to default
11

To understand the mechanism, let's see it with an example:

  1. I issue a traceroute to 44.12.44.1 from my PC
  2. My PC sends 3 UDP datagrams to 44.12.44.1 with TLL=1 and port=33434
  3. Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=2 and port=33435
  4. Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=3 and port=33436

It will keep doing that until TTL=32 and port=33465

When each one of those UDP datagrams goes through a router the TTL value is decremented and if it reaches zero, then the router returns an ICMP Time Exceeded Message, also known as ICMP Type 11.

My PC receives a lot of ICMP Time Exceeded Messages.

Checking the source IP adddresses of the ICMP message, my PC learns the IP's of the devices that are between itself and 44.12.44.1.

But it doesn't know the order. To know it, checks inside the ICMP message because it contains the header of the original UDP datagram. The UDP port minus 33434 gives the position of that device in the route to 44.12.44.1.

Keep in mind that Windows imnplementation of traceroute uses ICMP instead of UDP, that is used by Unix, Linux, BSD, etc.

Improve this answer
2
  • 2
    I don't know why your answer was downvoted, but it really explains the reason for the UDP port incrementation. You are right, it serves as identification number for the datagram order. Initially, I thought, traceroute is waiting until the reply is received or timed out before sending out the next datagram, but after capturing mysely I can confirm, that, indeed, traceroute sends out a bulk of UDP messages without waiting for the replies to arrive, thus, it increments each UDP port with +1, so that it can later identify them, when the replies arrive, and put them to output in correct order.
    – user30830
    Commented Nov 4, 2017 at 4:29
  • 1
    It's just worth pointing out that the intervening routers may well not send ICMP time exceeded, and even if they do, ICMP packets are delayed or dropped at whim by many public networks. Also, as the internet routes per packet, every single one of the 3 x N hops packets might go a different route. Which is why it's very frequently said that traceroute on networks you don't know in detail are approximations at best. Also worth knowing about are the record-route IP options, which have their own problems. You're free of course to devise your own network mapping algorithms.
    – jonathanjo
    Commented Sep 14, 2018 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.