1

I've noticed that when I use tracert a certain router(hop) always takes about 200ms to reply back, the rest reply's in 50ms, after digging into it with wireshark I've noticed that tracert uses normal ICMP echo requests with a TTL that will trigger an ICMP Time Exceeded from routers(hops),pinging this same router that takes 200ms to send back a Time Exceeded ICMP send's back echo reply with 11ms always! what could be the reason behind this ? is it possible that certain routers can filter even ICMP types to be delayed?

0

2 Answers 2

2

Creating ICMP messages is far down the priority list of a router. The primary function of a router is to route packets as fast as possible. Generating the ICMP message gets done when the router has time.

The router with the slow reply is probably very busy, and it gets around to sending a reply when it has time to do that.

2
  • if the same router is too busy to send a Time Exceeded reply every time tracert is done then how come he can reply with Echo Reply much faster? they're both ICMP
    – Naeem John
    Oct 28, 2020 at 20:27
  • There are different ICMP message. The Time Exceeded is an ICMP error message. ICMP error messages take some time to put together because it must take the original IP header and first 64-bits of the original message to prepend to the reply. Simply responding to an ICMP echo request really takes no time. Unfortunately, the ICMP for IPv4 is all mixed up for that. ICMPv6 for IPv6 did it right, and the error messages are numbers 1 to 127, and informational messages are 128 to 255.
    – Ron Maupin
    Oct 28, 2020 at 20:35
1

It's possible the replies actually traverse different network paths to reach you. Here's a ServerFault thread with relevant discussion: https://serverfault.com/questions/705115/icmp-replies-ingress-or-egress-interface-e-g-from-a-traceroute

To know for sure, you could compare the TTL of the arriving replies (this is different than the TTL printed out by traceroute) or check the actual behavior of the router in question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.