2

If I can ping a router successfully, why is it that when I do traceroute, it stops at a particular interface and says "ICMP type:3, code:3, Destination port unreachable". Doesn't that mean that it can't make a connection?

Here's my topology:

When I ping the Default_Gateway from any of the VPCs, it works. But when I do trace command, it stops at some interface and gives the error message I mentioned above. Is there something wrong or is that how it is?

FA1 ping Default_Gateway:

FA1> ping 123.45.250.1
84 bytes from 123.45.250.1 icmp_seq=1 ttl=253 time=35.980 ms
84 bytes from 123.45.250.1 icmp_seq=2 ttl=253 time=51.959 ms
84 bytes from 123.45.250.1 icmp_seq=3 ttl=253 time=31.955 ms
84 bytes from 123.45.250.1 icmp_seq=4 ttl=253 time=45.929 ms
84 bytes from 123.45.250.1 icmp_seq=5 ttl=253 time=40.067 ms

FA1 trace Default_Gateway: 

FA1> trace 123.45.250.1
trace to 123.45.250.1, 8 hops max, press Ctrl+C to stop
 1   123.45.8.1   8.898 ms  12.988 ms  8.000 ms
 2   123.45.250.5   22.986 ms  20.991 ms  19.013 ms
 3   *123.45.250.1   30.978 ms (ICMP type:3, code:3, Destination port unreachable)
Improve this question

1 Answer 1

Reset to default
3

That is because ping uses ICMP Echo Request and ICMP Echo Reply. Your traceroute is using UDP, which uses addresses called ports. Apparently, the port you are using in the traceroute commend is closed or denied on the destination, and the destination sends back an ICMP error message because of that. You didn't give the configuration for the Default Gateway router, so we cannot telly you the specific reason for the error.

Improve this answer
6
  • sorry. just edited
    – Kuni_Leqa
    Dec 25, 2018 at 1:46
  • It appears that IOS on that device does not have the UDP port for traceroute open, so it is sending back an ICMP error message explaining that.
    – Ron Maupin ♦
    Dec 25, 2018 at 1:49
  • What if we changed the port to one used by a protocol we know will reach the destination? // For example, I have a host I know is reachable by SSH login (it currently has auth issues, but at least it gets there). I thought 'traceroute -p 22 ip' would run all the way, but it still times out after the same number of hops. I figure there's a specific router that's rejecting UDP packets, but it can't both reject and accept SSH packets... right?
    – Paul Brinkley
    Jun 1 at 18:14
  • Some routers are configured to not send back such ICMP errors, and some get too busy to send in the time window for the traceroute application because a router's primary job is to route packets as fast as possible, while send ICMP errors is put off until a router has time to send them. A timeout on one or more routers in a path is not unusual, especially if you use a traceroute application that uses ICMP, e.g. the Windows tracert.
    – Ron Maupin ♦
    Jun 1 at 18:24
  • 1
    The ICMP problem is that traceroute needs an ICMP error from the router, not that the host sends ICMP. Traceroute works by receiving ICMP errors, regardless of the protocol used to send the explore packets.
    – Ron Maupin ♦
    Jun 1 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.