Why there are ip(ip) and domain(ip) 's difference and multi rows records in the traceroute?

Question

In the traceroute command:

$ traceroute 104.43.54.2
traceroute to 104.43.54.2 (104.43.54.2), 64 hops max, 52 byte packets
 1  10.10.10.1 (10.10.10.1)  4.852 ms  4.623 ms  1.588 ms
 2  100.64.0.1 (100.64.0.1)  8.808 ms  10.895 ms  8.823 ms
 3  182.138.108.153 (182.138.108.153)  11.466 ms *  12.800 ms
 4  171.208.203.73 (171.208.203.73)  12.107 ms
    171.208.198.29 (171.208.198.29)  9.733 ms
    171.208.203.65 (171.208.203.65)  5.950 ms
 5  202.97.36.221 (202.97.36.221)  44.352 ms  45.386 ms  47.354 ms
 6  202.97.90.170 (202.97.90.170)  55.260 ms
    202.97.66.154 (202.97.66.154)  43.573 ms
    202.97.90.170 (202.97.90.170)  41.755 ms
 7  202.97.94.77 (202.97.94.77)  68.178 ms
    202.97.91.145 (202.97.91.145)  41.120 ms  38.737 ms
 8  202.97.57.81 (202.97.57.81)  54.497 ms  48.810 ms  48.332 ms
 9  202.97.121.198 (202.97.121.198)  74.393 ms  44.649 ms  41.414 ms
10  ae26-0.icr02.hkg31.ntwk.msn.net (104.44.236.209)  46.573 ms  49.441 ms  53.710 ms
11  ae25-0.hkb-96cbe-1b.ntwk.msn.net (104.44.236.206)  54.067 ms  45.355 ms  76.172 ms
12  ae36-0.sge-96cbe-1b.ntwk.msn.net (104.44.224.255)  73.793 ms  97.979 ms  81.148 ms
13  ae18-0.sge-96cbe-1a.ntwk.msn.net (104.44.226.168)  80.137 ms  74.344 ms
    ae38-0.icr02.sg2.ntwk.msn.net (104.44.236.146)  73.529 ms
14  * ae28-0.icr01.sg2.ntwk.msn.net (104.44.236.136)  115.877 ms  92.173 ms
15  * * *
16  * * *
17  * * *
18  * *

I have some questions about the shows,

1) What's the difference between 171.208.203.65 (171.208.203.65) and ae38-0.icr02.sg2.ntwk.msn.net (104.44.236.146)? one is ip(ip) and the other is domain(ip).

2) in the 4, 6, 7, and 13, there are two rows of records :

13  ae18-0.sge-96cbe-1a.ntwk.msn.net (104.44.226.168)  80.137 ms  74.344 ms
    ae38-0.icr02.sg2.ntwk.msn.net (104.44.236.146)  73.529 ms 

why?

Answer 1

1) Traceroute may attempt to resolve the hop's domain name via DNS. As you didn't include any additional flags to explicitly enable this functionality, your traceroute application does so by default. If you just see an IP address, it wasn't able to resolve it.

2) This is because a different path was taken on successive traces. Since traceroute works by sending a series of probes with an increasing TTL, each successive probe may end up taking a different path. If multiple distinct routers are seen at the same hop while running a single trace, you've hit a spot where traffic may be load balanced between two routers, for example.

• It's important to remember that the path traceroute shows you isn't discovered by a single packet -- it's multiple -- as many as are required to eventually receive a response from the destination.

The Linux man page has a nice explanation of traceroute's behavior: http://man7.org/linux/man-pages/man8/traceroute.8.html

Answer 2

1 - it is because your traceroute client is performing reverse DNS lookup. I.E. it asks to the DNS server which is the domain name associated with this IP address. In one case, there's no such reverse record, so the IP address is displayed in place in the domain name. In the other case, there's a reverse record for this IP address and so traceroute display it.

Using traceroute -n, traceroute will not perform the reverse DNS lookup, saving time. Use man traceroutefor more details.

2 - this is probably due to a kind of load-balancing feature: there's 2 (or more) devices capable of responding for this IP address and both responded.