Unlike it's Unix/Linux counterpart, the Windows tracert software doesn't seem to have flags to switch between ICMP and UDP. Does anyone know for certain which it uses?

I am having trouble with two machines on the same network. I can ping from one to the other, but I am unable to perform a tracert.

  • There are tools that people have created to use UDP for traceroute on Windows rather than default ICMP which Windows seems to use. If you google "Windows UDP Traceroute" you will find some of the tools. – SleepyMan Jan 4 '17 at 15:19
  • This isn't guaranteed to be supported any more but you could create a traceroute util entirely in windows "rawsockets" similar to winsock. – marshal craft Jan 4 '17 at 16:46

You can't use traceroute or tracert on the same network because it counts router hops. It uses the IP TTL that is decremented by routers, but devices on the same network communicate directly, not through a router, so the TTL will never be decremented, and a router will not generate an ICMP message telling traceroute or tracert that the TTL timed out.

| improve this answer | |
  • Oh, yeah that makes sense. Strangely enough though, no matter how many times I ping the other machine, I don't see a record of that machine in the arp tables. How is it using the link layer without this? – mreff555 Jan 4 '17 at 16:01
  • But woudn't the end host (possibly on the same network) reply something that traceroute would display (echo reply if probing w/ echo request, ICMP port unreach if probing w/ UDP, TCP RST if probing w/ TCP SYN)? I think that's what it does on linux. – JeanPierre Jan 4 '17 at 16:07
  • @mreff555, unfortunately, host questions are off-topic here. You are better off asking that on Server Fault or Super User. – Ron Maupin Jan 4 '17 at 16:08
  • @JeanPierre, no. Tracert uses a particular ICMP message that says the TTL expired. ICMP is a completely different protocol than TCP or UDP. ICMP is part of IP, which is layer-3, but TCP and UDP are layer-4. ICMP packets do not contain TCP or UDP datagrams, and ICMP knows nothing about layer-4 protocols or ports. – Ron Maupin Jan 4 '17 at 16:11
  • traceroute sends probes (the linux version can use ICMP echo request messages, UDP datagrams or TCP SYN segments) encapsulated in packets with increasing TTLs. Routers send back a ICMP ttl expired when the received probe gets its TTL down to 0. The probe that has a TTL large enough will be received by the destination that will reply accordingly (but may also decide to just ignore the probe depending on firewall rules and so). Do we agree on that? – JeanPierre Jan 4 '17 at 16:32

Windows uses ICMP echoes for traceroute (tracert), while most *nix systems (including Cisco routers) use UDP.

Note: traceroute in Linux can use ICMP with the -I option.

| improve this answer | |
  • and TCP in current version. – Jens Link Jan 4 '17 at 15:54

It uses icmp for sure. Would you mind to post the error message?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.