3

I have some questions about why traceroute doesn't works in some condition. Though I understand how it works, I can't figure out some questions. Like,

$traceroute www.google.com
 1  * * *
 2  * * *
......

There are '*'. When I use ICMP stead for UDP, I got those below:

$traceroute www.google.com -I
 1  * * *
 2  * * *
 3  222.42.254.130 (222.42.254.130)  7.980 ms  10.785 ms  4.920 ms
 4  222.42.254.129 (222.42.254.129)  4.363 ms  8.141 ms  5.849 ms
 5  bogon (10.2.1.1)  7.957 ms  7.787 ms  8.321 ms
 6  61.237.121.97 (61.237.121.97)  25.341 ms  24.895 ms  28.725 ms
 7  61.237.123.66 (61.237.123.66)  23.738 ms  24.172 ms  23.916 ms
 8  221.4.120.173 (221.4.120.173)  23.096 ms  24.539 ms  20.827 ms
 9  221.4.6.61 (221.4.6.61)  58.516 ms  60.035 ms  63.200 ms
10  120.80.0.73 (120.80.0.73)  60.991 ms  59.520 ms  59.853 ms
11  219.158.19.69 (219.158.19.69)  59.771 ms  59.192 ms  59.072 ms
12  219.158.22.249 (219.158.22.249)  89.185 ms  87.928 ms  89.582 ms
13  219.158.22.158 (219.158.22.158)  102.195 ms  103.409 ms  106.153 ms
14  219.158.35.114 (219.158.35.114)  218.816 ms  224.845 ms  218.470 ms
15  203.208.62.15 (203.208.62.15)  212.560 ms  208.640 ms *
16  chrome.google.com (203.208.46.1)  210.655 ms *  216.369 ms

I wonder why the first and second hop is still unknown. I have tried to set icmp rate with -z 500, but it's useless. So my questions are below:

  1. Why did I get some hops while I use ICMP?
  2. How can I get the first two hops?

I have searched for that, but I got nothing useless. I connect to the Internet through a route without any firewall. Thank you for your help.

2
  • I don't know much about networking, but maybe the two first hops don't return any information, even thought the time to live of the packet is zero when they get it, and just simply drop it? Anyway, this question should probably be moved to Superuser or Server Fault, there's probably more people knowing about these things in those sites...
    – esaj
    Nov 20, 2011 at 14:48
  • It means that the first two hops did not provide an ICMP reply, and that the ICMP echo request has timed out. Also, keep in mind that the information is historical, it may or may not reflect the current state of the network, and may or may not reflect the path 'real' data might take.
    – dbasnett
    Nov 24, 2011 at 14:13

3 Answers 3

2

As the Traceroute is based on ICMP Echo requests, then it seems like the first two routes in your way (probably your own premises firewalls) are configured to Drop/Block ICMP echo requests. Thats is why Traceroute is unable to see the actual response from the first two, but proper response beyond that.

1
  • I think it's possible my route doesn't send any 'time exceeded' ICMP message. When I tried to traceroute to the gateway, it would get response immediately.
    – robotment
    Nov 21, 2011 at 8:13
2

The first hop is your gateway to the internet, you can see that with netstat -rn.

The second hop is the gateway at your provider, if you happen to have something like a Fritzbox, you can see the ip-address there.

1
  • Maybe my route doesn't send 'time exceeded' message. When I type 'traceroute 192.168.1.1', it will get the response immediately. Thank you any way.
    – robotment
    Nov 21, 2011 at 8:14
1

In order to complete the next-hop discovery you can use another tool : hping. As the previous response of Franck explain, there is probably a firewall or router that drop the kind of ICMP message.

For example, you can use this command for the first next-hop:

hping www.google.com -p 86 -S -t 1

An also this one for see the second:

hping www.google.com -p 86 -S -t 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .