1

According to here:

...the round trip time (RTT) for your packet to reach that point and return to your computer.

And in the example, it shows:

enter image description here

The RTT for hop 5 is smaller than hop 4.

But

RTT_4 = t1 + t2 + t5

RTT_5 = t1 + t2 + t3 + t6

How could RTT_5 < RTT_4? Or is it because it's possible that t3 + t6 < t5?

enter image description here

ADD 1 - 10:49 AM 3/21/2022

(Thanks to Ron Mauphin's answer.)

I think my previous illustration of how traceroute works is wrong. It should be like this:

RTT (Round Trip Time) = t1 + t2 + t3
TTL = number of hops

IMPORTANT NOTE

The lines are dashed because they are not necessarily direct traffic. There can be routers in the middle. Traceroute only cares about the source and destination of each line.

enter image description here

Traceroute is a smart tool that leverages the TTL and ICMP timeout error message sent by a router when a packet's TTL reaches 0. The effective result is to roughly obtain the path through which a source reaches the destination and the RTT to each of the nodes in the middle. It is rough because there's no guarantee that the nodes show by the traceroute is really/strictly one after another. It is possible that each probe packet sent by the traceroute goes through a completely different path which doesn't include all the previous middle nodes probed before.

Strictly speaking, traceroute essentially probes with a increasing distance (the TTL, i.e. max allowed hop number). It sends out 3 packets but even these 3 packets cannot be guaranteed to follow the same path. It doesn't at all measure the latency. It merely says 2 things:

  • With how much TTL where can be reached for this time.
  • And if a certain destination can be reached within the specified max TTL/hops.

But still, it is useful.

A related thread: Explanation of traceroute

Improve this question
0

1 Answer 1

Reset to default
1

It is because the slower router is busy routing packets (its primary job), and creating ICMP message is a low priority, so it takes its time to generate the ICMP reply.

If you understand how traceroute works, it sends a packet with the TTL starting at 1, and the first router decrements the TTL to 0, dropping the packet and sending back an ICMP message that the packet expired in transit. Then traceroute incre ments the TTL to 2 and sends another packet, so it is the second router that decrements the TTL to 0 and replies with the ICMP message.

Traceroute repeats that, incrementing the packet TTL and getting ICMP replies. It often happens that routers are busy routing, and it can take longer to generate the reply that subsequent routers.

Remember that routers can be configured to not send the ICMP message. Tracweroute is really only a useful tool on your own network where you know how things should be routed.

Improve this answer
8
  • Thanks. Then it is possible that the 2nd packet that reaches router 2 doesn’t go through router 1 at all, theoretically. I mean a totally different path.
    – smwikipedia
    Mar 20 at 15:49
  • 1
    Its possible, but unlikely. When it passes through a slow router, it is simply a paket with a good TTL, and routing that is the routers primary job, so it is only the creation of ICMP replies by the router that decrements to 0 that is the slowdown. The RT includes the final routers processing time, and only the router that decrements to 0 need to process and create the ICMP message as a low priority.
    – Ron Maupin ♦
    Mar 20 at 15:54
  • Thanks. I updated my post with ADD1.
    – smwikipedia
    Mar 21 at 2:52
  • 1
    What your diagram misses is that the ICMP replies do not flow directly between later routers and the source. As test packets with non-expiring TTLs pass through a router, they are regular packets that the router considers it priority job, but when a packet expires on a router, it will be delayed because tge router is busy passing regular packets, and generating the ICMP packet expired messages is a low priority. As the messages pass back to the source, they are regular packets that the intermediate routers pass at the normal priority. The difference is the ICMP message creation time.
    – Ron Maupin ♦
    Mar 21 at 3:00
  • 1
    You get the interface address of the interface of the router where the TTL expired. Traceroute is really only useful on your own network where you know the correct behavior, and you want to verify it or troubleshoot a problem. Running it on an unknown network really cannot be trusted because some ISPs look for low TTL numbers and send it through a different path than normal packets so that you cannot casually do network discovery.
    – Ron Maupin ♦
    Mar 21 at 3:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.