For the homework, I executed tracert command in the cmd to a specific site.

I got the result and there was a sudden increasing point, but it was strange.

I'm Korean and I used tracert to US site so I thought an increasing point will be Korean-->US.

But it was wrong, an increasing point has occurred between routers of Korea, can this kind of increasing occur? What is the reason?


In general there are two main sources of latency steps.

  1. Long distance links.
  2. Congestion resulting in queues.

Many networks contain routers seperated by large geographic distances, so yes it is absoloutely normal to see large steps in latency within a network.

If you see the expected step in latency for an intercontinental connection but not at the expected place in the trace, the most likely explanation is that the routers were not where you thought they were. IP addresses and reverse DNS hostnames only give a weak hint as to the physical location of the device they are assigned to.

Specifically I expect that your korean provider has a router that is physically located in the US to give them more flexibility in purchasing onward conncectivity, but you were unable to correctly identify the physical location of the router from it's reverse DNS name (either because the information was not there, because you were unable to figure out what the name meant or even because the information in the name was flat out wrong).

(if you see a hop with higher response times than later hops then that indicates slow ICMP generation or inconsistent routing but if the response times are consistently increasing through the trace then the latency is most likely real).

| improve this answer | |
  • Thank you for your clear explanation. What you mean is that ip address can be different from physical location? – baeharam Sep 11 '18 at 15:59
  • Right, ultimately IP addresses are assigned to ISPs who in-turn assign them to their networks. Inter-router links in particular tend to be more about network topology than physical location. If your provider has a link from Korea to America then both ends of that link will likely have IPs on the same subnet despite being thousands of miles apart. – Peter Green Sep 11 '18 at 16:23
  • Geoip datbases and whois are not fine grained enough to be useful here. Reverse DNS can be useful but there is no standard format and no gaurantee that the provider will keep the entries up to date. In my experiance many providers use abbreviated city names, for example "lon" for london, "nyc" for new york city, "sfo" for san fransisco and so-on. – Peter Green Sep 11 '18 at 16:26

Tracert depends on the routers sending back an ICMP message to the originating host. Routers are designed to route as the primary function. ICMP message generation is low on a router's priority, so a busy router will put off generating the message while it is busy routing. You may notice that the intermediate routers take a longer time to reply that the final destination because those routers are busy routing.

Some intermediate routers may even time out because they are too busy, or they may have the ICMP message generation turned off.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.