0

When using the traceroute command. For example:

$ traceroute google.com

The output I get shows

hop No. | hostname (ip) | latency 1 | latency 2 | latency 3

Which for google shows the following:

traceroute to google.com (216.58.223.14), 64 hops max, 52 byte packets
 1  192.168.119.1 (192.168.119.1)  1.321 ms  0.980 ms  0.936 ms
 2  rtr3-c16-dc1.macrolan.co.za (41.222.225.255)  1.815 ms  1.578 ms  1.788 ms
 3  ae0.0.rtr1-ca12-tc1.macrolan.co.za (154.70.222.7)  1.861 ms  2.603 ms  1.989 ms
 4  xe-0/0/3.4000.rtr1-c3h12-tc2.macrolan.co.za (129.205.134.27)  38.447 ms  46.682 ms  21.668 ms
 5  google.ixp.joburg (196.60.8.166)  17.787 ms  18.059 ms  17.713 ms
 6  72.14.237.239 (72.14.237.239)  17.668 ms  17.882 ms  17.497 ms
 7  jnb01s07-in-f14.1e100.net (216.58.223.14)  17.528 ms  18.004 ms  17.642 ms

Considering that TCP requests receive ACKs from the destination, and not individual hop destinations, I assume that traceroute therefore has to identify individual hop destinations in order to assess latency between the different hops.

Is this correct? If so, how does it do this?

Improve this question
1
  • 1
    Check this answer
    – jcbermu
    Commented Sep 20, 2018 at 8:21

2 Answers 2

Reset to default
1

Traceroute works by sending a packet to the destination host, but with very a small time-to-live fields of 1. If a router on the way discards the packet because the TTL isn't high enough, it sends an ICMP "TTL exceeded" message back to the originator. Which then sends a packet with TTL=2 and so on. (And in fact typically sends three packets for a given TTL.)

This is a very approximate method of finding the route because

  • Routes can change from one packet to the next
  • Many routers don't send ICMP TTL exceeded messages
  • Many routers do different things for different kinds of packets

Traceroute is only really helpful on your own networks where you know what's supposed to happen. Traceroute timings are especially variable.

Specifically to your question:

  • Different implementations of traceroute send different kinds of packets, so there might be no TCP involved at all
  • Even if the originator is sending TCP opens, no TCP connection is achieved because the TCP open doesn't reach the target
  • So there are no TCP ACKs available until the actual host is received
Improve this answer
2
  • Thank you - does that mean that the hops between the source and destination are obtained via ICMP messages sent back due to expired TTLs?
    – Zach Smith
    Commented Sep 20, 2018 at 8:27
  • Yes exactly: it's well worth doing packet capture such as tcpdump or wireshark and doing traceroute. It becomes very clear.
    – jonathanjo
    Commented Sep 20, 2018 at 8:30
0

https://www.nanog.org/meetings/nanog47/presentations/Sunday/RAS_Traceroute_N47_Sun.pdf is an amazing resource for really understanding traceroute.

Improve this answer
1
  • Product or resource recommendations are explicitly off-topic here, and link-only answers are discouraged because this is an archive, and links will go bad over time. You should put the relevant content in your answer and provide the link as backup and further reading.
    – Ron Maupin ♦
    Commented Sep 20, 2018 at 13:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.