1. PC1 LAN GW SP RTR1 SP RTR2 DST 4 * 25 ms 21 ms dst [4.168.18.3] 4. A third packet is sent with TTL=3, which decrements at each hop, and expires after RTR2, so a message is sent to PC1. 5. The last packet is sent with TTL=4, which expires at DST and PC1 then knows it has reached the target. Note that even though RTR2 did not respond, it DID forward the last packet to DST. The last packet had to traverse RTR2 to get to DST, indicating there is no ‘trouble’ with RTR2 except it did not send a Time Exceeded message back to PC1. 1. Traceroute is initiated by PC1 1 <1 ms <1 ms <1 ms 172.16.96.1 2. ICMP packet is sent with TTL=1, it expires at the first hop (LAN GW), and is sent back to the PC, which shows the first hop in the traceroute 2 15 ms 22 ms 31 ms rtr1 [4.132.159.25] 3 * * * rtr2 [4.144.175.42] 3. Another packet is sent with TTL=2, it expires after RTR1, so a Time Exceeded message is sent back through to PC1.

2. Reasons an intermediary hop may not respond SPD – Router chooses to drop management traffic to prioritize through traffic http://www.cisco.com/web/about/security/intelligence/spd.html http://www.cisco.com/web/about/security/intelligence/spd.html Route Changes – if there is multiple equal cost paths (load balancing), each traceroute message may take a different path, giving the illusion of not reaching that hop on subsequent attempts. This often shows up as 1 or 2 stars at a hop along with a third response. The number of stars depends on the number of possible paths. Router configured to drop Traceroute – Because of the information that traceroute can reveal, some operators choose to ignore/drop traceroute requests. Router’s IP address is not reachable – If the client has no path to or from the non-responding hop, it will not respond. A common culprit is using private (RFC1918) IP space on either the client, or the router. Read more here: http://www.lincoln.edu/math/rmyrick/ComputerNetworks/InetReference/54.htm

3. Things to Remember Traceroute can be done using ICMP (Windows) or UDP (*nix & network routers)network routers Traceroute is not a single packet, but a round trip packet (probe) for each hop. If the n th hop is reachable, it had to travel through all previous hops there and back! If latency or packet loss occurs at a hop but not subsequent hop(s), then you should not consider the latency or packet loss at that hop. Tools like ‘tcptraceroute’ can be used to get responses to routers that block icmp and/or udp traceroutes.tcptraceroute