Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I asked this question at Stack Overflow and then thought this may be the better place to ask.

Given the following situation:

PC --- |aa RTR1 bb| --- |aa RTR2 bb| --- |aa RTR3 bb| etc

Each of the |aa rtr bb| is meant to be a router with two ports aa and bb.

My question is this. When you do a trace route from PC which router port address should respond with time to live exceeded in transit message?

I seem to remember being taught to think of the router as being in as many parts as ports, so that in my scenario when aa is forwarding the packet to bb and decrements the ttl to 0, it will be the address of the aa port in the failure message. I am trying to find the definitive answer.


share|improve this question
up vote 3 down vote accepted

Without going too far into how routing works. You will only every see responses from the interface that is "facing" you machine.

So you in your example, the TTL Exceeded message would always come from one of the 'aa' interfaces. Basically the logic that processes the packet happens in between the two interfaces, and then any response or forward is sent out the correct interface. In you case a TTL exceeded message would be sent out of 'aa' because that is the only way to get back to your machine.

share|improve this answer
That is what I have always thought, but I can't find a reference for it, like RFC reference. And so you don't have to worry about going to far into how routing works, my first router was Cisco AGS+ around 1990. – dbasnett Apr 2 '10 at 16:26
@dbasnett: I don't think you would find an RFC reference, it's just a function of how the router rewrites the packet headers. – Zypher Apr 2 '10 at 16:34
I would have voted for you, but the trend seems to be talk down to everyone. You are the second person in as many days to have made that mistake with me. – dbasnett Apr 2 '10 at 16:35
@dbasnett: I'm sorry if you felt talked down to it was not my intention. – Zypher Apr 2 '10 at 17:33

Definitive response, maybe not, but it is the case in all the tests I do. I think the router can not route as the TTL is null, so before routing, the ICMP packet is sent. So it is the first IP found in the path.

share|improve this answer
I guess I wasn't clear. When the trace route starts, and the TTL is 1, and RTR1 gets the packet, decrements the TTL, finds it to be 0, will RTR1 respond with port aa's address or port bb's address? – dbasnett Apr 2 '10 at 14:11
The router will respond with the address of the interface that received the packet. As you've drawn your diagram, all of the routers would respond to a traceroute from your PC with the IP of their aa interfaces. – James Sneeringer Apr 2 '10 at 14:41
That is what I have always thought, but I can't find a reference for it, like RFC reference. In my Cisco days that was the answer. The problem I am seeing is with some (all) home / office routers. With the same manufacturer I see the correct port (aa), the incorrect port (bb). My favorite is with one that looks like it is two hops in the router, a timeout, then a bad (bb) response. I thought it was ARP, but it wasn't, and not load related. – dbasnett Apr 2 '10 at 16:32

«will RTR1 respond with port aa's address or port bb's address»

It is totally arbitrary and a somewhat silly question.

Consider the case where the ICMP is coming in by way of port 'aa' but it is actually targeted the the address of port 'bb': which one should be the source address in the ICM reply? 'aa'? 'bb'? or whatever other address the router has got?

»think of the router as being in as many parts as ports»

Nodes (touter's or computers) don't have addresses in the TCP design, only interfaces have addresses but ICMP is done by nodes not interfaces. This opens up a fair amount of ambiguities. They are in effect intentional. Note that the Linux TCP/IP stack has a somewhat different design, but it is deviant.

share|improve this answer
I disagree that it's either arbitrary or silly. Considering some function of network operation to be arbitrary is what's silly. No offense. – Matt Simmons Apr 4 '10 at 17:46
Thanks bliss. As I have previously stated I agreee that it should always be the aa port, and that it is my opinion that the problems I saw was directly related to the poor implementation of some low-end router manufacturers. – dbasnett Apr 5 '10 at 1:23

As the others pointed out, most of the time routers will answer from the 'aa' interface. Since I can't post comments yet, I will complement the previous answers here. It is also possible to have unnumbered interfaces on point-to-point links between routers, if you want to save some IP addresses, and you are not interested in pinging interfaces seprately. In this case you can access the router by the IP address assigned to the loopback interface, and this address will be the one you will also see in traceroutes.

This however is an exceptional case, and not a particulary good operational practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.