0

I asked this question at Stack Overflow and then thought this may be the better place to ask.

Given the following situation:

PC --- |aa RTR1 bb| --- |aa RTR2 bb| --- |aa RTR3 bb| etc

Each of the |aa rtr bb| is meant to be a router with two ports aa and bb.

My question is this. When you do a trace route from PC which router port address should respond with time to live exceeded in transit message?

I seem to remember being taught to think of the router as being in as many parts as ports, so that in my scenario when aa is forwarding the packet to bb and decrements the ttl to 0, it will be the address of the aa port in the failure message. I am trying to find the definitive answer.

Thanks.

Improve this question

4 Answers 4

Reset to default
3

Without going too far into how routing works. You will only every see responses from the interface that is "facing" you machine.

So you in your example, the TTL Exceeded message would always come from one of the 'aa' interfaces. Basically the logic that processes the packet happens in between the two interfaces, and then any response or forward is sent out the correct interface. In you case a TTL exceeded message would be sent out of 'aa' because that is the only way to get back to your machine.

Improve this answer
4
  • That is what I have always thought, but I can't find a reference for it, like RFC reference. And so you don't have to worry about going to far into how routing works, my first router was Cisco AGS+ around 1990.
    – dbasnett
    Apr 2, 2010 at 16:26
  • @dbasnett: I don't think you would find an RFC reference, it's just a function of how the router rewrites the packet headers.
    – Zypher
    Apr 2, 2010 at 16:34
  • I would have voted for you, but the trend seems to be talk down to everyone. You are the second person in as many days to have made that mistake with me.
    – dbasnett
    Apr 2, 2010 at 16:35
  • 1
    @dbasnett: I'm sorry if you felt talked down to it was not my intention.
    – Zypher
    Apr 2, 2010 at 17:33
1

Definitive response, maybe not, but it is the case in all the tests I do. I think the router can not route as the TTL is null, so before routing, the ICMP packet is sent. So it is the first IP found in the path.

Improve this answer
3
  • I guess I wasn't clear. When the trace route starts, and the TTL is 1, and RTR1 gets the packet, decrements the TTL, finds it to be 0, will RTR1 respond with port aa's address or port bb's address?
    – dbasnett
    Apr 2, 2010 at 14:11
  • 2
    The router will respond with the address of the interface that received the packet. As you've drawn your diagram, all of the routers would respond to a traceroute from your PC with the IP of their aa interfaces.
    – James Sneeringer
    Apr 2, 2010 at 14:41
  • That is what I have always thought, but I can't find a reference for it, like RFC reference. In my Cisco days that was the answer. The problem I am seeing is with some (all) home / office routers. With the same manufacturer I see the correct port (aa), the incorrect port (bb). My favorite is with one that looks like it is two hops in the router, a timeout, then a bad (bb) response. I thought it was ARP, but it wasn't, and not load related.
    – dbasnett
    Apr 2, 2010 at 16:32
0

«will RTR1 respond with port aa's address or port bb's address»

It is totally arbitrary and a somewhat silly question.

Consider the case where the ICMP is coming in by way of port 'aa' but it is actually targeted the the address of port 'bb': which one should be the source address in the ICM reply? 'aa'? 'bb'? or whatever other address the router has got?

»think of the router as being in as many parts as ports»

Nodes (touter's or computers) don't have addresses in the TCP design, only interfaces have addresses but ICMP is done by nodes not interfaces. This opens up a fair amount of ambiguities. They are in effect intentional. Note that the Linux TCP/IP stack has a somewhat different design, but it is deviant.

Improve this answer
2
  • I disagree that it's either arbitrary or silly. Considering some function of network operation to be arbitrary is what's silly. No offense.
    – Matt Simmons
    Apr 4, 2010 at 17:46
  • Thanks bliss. As I have previously stated I agreee that it should always be the aa port, and that it is my opinion that the problems I saw was directly related to the poor implementation of some low-end router manufacturers.
    – dbasnett
    Apr 5, 2010 at 1:23
0

As the others pointed out, most of the time routers will answer from the 'aa' interface. Since I can't post comments yet, I will complement the previous answers here. It is also possible to have unnumbered interfaces on point-to-point links between routers, if you want to save some IP addresses, and you are not interested in pinging interfaces seprately. In this case you can access the router by the IP address assigned to the loopback interface, and this address will be the one you will also see in traceroutes.

This however is an exceptional case, and not a particulary good operational practice.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .