1

I know traceroute in BSD uses UDP by default and gets ICMP error message from intermediate hops when TTL is decremented and found to be 0. My question is - what if we trace route to next-hop router: - Should the router respond with port unreachable message?

  • 4
    Should be easy enough to test. – Ron Trunk Feb 26 '15 at 16:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:31
3

As Ron said, this is a pretty simple thing to test - you should give it a try if you haven't already.

In BSD systems traceroute will use a range of high, unregistered UDP port numbers as well as TTL. The device originating the probes will send 3 probes, they will look like this:

NOTE: The port numbers won't necessarily be exact in your tests.

  • Probe 1: TTL = 1 UDP Port = 33434
  • Probe 2: TTL = 1 UDP Port = 33435
  • Probe 3: TTL = 1 UDP Port = 33436

In the condition that the we're NOT tracerouting to the next-hop, you will see the following message from the next device:

Time to Live Exceeded

This is what we would expect, to see as traceroute progresses, the next device's probes would look like this:

  • Probe 1: TTL = 2 UDP Port = 33437
  • Probe 2: TTL = 2 UDP Port = 33438
  • Probe 3: TTL = 2 UDP Port = 33439

Now let's say that second set of probes will reach our intended destination. The response we will get is (and this is a portion directly from tcpdump):

udp port 33437 unreachable

Now what does this mean? It means we've reached our destination, because only our destination can say "No this port is not available" (as we would expect from the higher unregistered UDP port range).

My question is - what if we trace route to next-hop router: - Should the router respond with port unreachable message?

The cool thing about traceroute is that, it has no idea if you're trying to hit something 20 hops away, or just 1 hop away - it needs to be able to adapt to any of those situations.

So it will behave no differently than it would at the last hop in a 20 hop traceroute.

If you traceroute your next hop, your probes would look the same:

  • Probe 1: TTL = 1 UDP Port = 33434
  • Probe 2: TTL = 1 UDP Port = 33435
  • Probe 3: TTL = 1 UDP Port = 33436

But the different here is, a TTL of 1 is enough to get to your next hop. So you would see the "udp port XXXXX unreachable" message right away, implying that the traceroute has completed. Instead of seeing the "Time to Live Exceeded" messages.

I hope this helps clear things up, if you have any other questions related to this - leave a comment and I'll be happy to update my answer.

0

The router will do whatever it is configured to do. ICMP messages are a courtesy and traffic can be silently discarded or an ICMP response can be provided. This is an optional part of the protocol. There are two schools of thought on whether a router should send the ICMP response. The first is that it allows visibility into the network and allows you to troubleshoot problems, while the second regards it as a security risk believing that obscuring your visibility of the device provides security.

-4

Traceroute is used to find the hops between you and the destination. In between the hop count whatever the number of hops the TTL is not affected, TTL is concerned with routing protocols. If you do a traceroute and you get unreachable that means you will have a connection problem between you ( the host) and the destination. try checking the physical layer, layer 2 and of course layer 3 ( because I doubt that you can even ping).

  • WRONG!!!! Routers decrement packets' TTL value by 1 when routing and discard packets whose TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded.[2] Common default values for TTL are 128 (Windows OS) and 64 (Unix-based OS).Traceroute works by sending packets with gradually increasing TTL value, starting with TTL value of 1 – BeachSamurai Mar 9 '15 at 9:30
  • 1
    -1 "If you do a traceroute and you get unreachable that means you will have a connection problem" Not if you're using UDP traceroute like the question asks about. – Jordan Head Mar 10 '15 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.