I ran a traceroute on a url to a server we own in New York. I'm in central Florida. Traceroute showed the request being directed to west Florida and then far south Florida before finally being directed north to Virginia and then New York. I thought edge routers could discover more direct routes. What would cause the request to not start hoping north from the start? Is this controlled by my ISP?

  • Short answer: Yes the route is controlled by your ISP. The organization you use for internet service has chosen to route you like this. They have designated internet egress points whose locations were chosen for reasons you probably could only speculate about. – Mike Pennington Aug 23 '18 at 18:46

The virtual world and physical world rarely line up. Just because machines are physically close, doesn't make them logically close. Traffic goes where routing entries, and interconnects take it.

Eons ago, I demonstrated this very thing with two PCs sitting on the same table. Each dialed into different ISPs. Packets between the machines went half way around the country. Why? Because the two ISPs aren't locally peered. The traffic has to flow to where ever the two meet -- or be handed to intermediate carrier(s) who can bridge the gap.

Less eons ago, the ISP I worked for fixed such a problem for a customer. They came to us with issues transferring large blocks of (weather) data. Despite the end-points being 30mi apart, the packets were traveling thousands of miles. Private peering with MCNC (NCREN) turned a 7-hop, +50ms delay into a single (IP) hop of less than 4ms. (It was 5 hops, but you can't see ATM (layer2) with IP (layer3))

Think of it like rivers. If you're on a raft in one, getting to the other may take miles before they hit a common body of water. "But I can see the other river!" doesn't matter when the waters from each don't mix.

| improve this answer | |

The Internet is composed of ISPs connected to each other, passing traffic from one to the other. As your traffic passes from ISP to ISP, each ISP makes its own decisions on how to route your traffic, and some ISPs do not want you to casually discover their internal networks, so they have various methods to detect traceroute and reroute it, or they may use MPLS, tunnels, etc., where you do not see all the hops along the way.

The result is that what you see in traceroute on the public Internet may bear no resemblance to how your normal traffic traverses the public Internet. Traceroute is a very useful tool for use on your own network, where you know what the results should be, but it can be very misleading when you use it on the public Internet or a network not controlled by you.

Also, remember that a more direct path may not be the best or fastest path.

| improve this answer | |
  • 1
    detect traceroute and reroute it Stop with the conspiracy theories. – Ricky Beam Aug 23 '18 at 17:43
  • I know of a couple of ISPs (one very large, and a medium-sized ISP) that do this. Also, it pops up from time to time on Stack Overflow and Super User where a, ISP detects traceroute and puts it into a loop. We even had a question here, on Network Engineering, where a programmer was asking how to detect traceroute packets in order to manipulate them. I'm not claiming all ISPs do this, but you really have no way to know if your traceroute packets end up passing through an ISP that does something with them. – Ron Maupin Aug 23 '18 at 18:01
  • It's far more common for inconsistent results because of load balancing and multipathing. (and that traceroute tends to use UDP) – Ricky Beam Aug 23 '18 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy