Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Any ideas why a tracert (traceroute) to an external host would return with the following:

tracert 10.34.25.23

 1  myborderouter.example3.com (10.52.2.41)  1.113 ms  1.103 ms  1.100 ms
 2  ae0--931.maincorerouter.example2.com (10.102.65.44)  4.028 ms  4.046 ms  4.042 ms
 3  gi0-1.mainrouter.example2.com (10.72.12.85)  6.653 ms  6.661 ms  6.645 ms
 4  * * *
 5  somebox.example.com (10.34.25.23)  7.361 ms  7.339 ms  8.723 ms
 6  somebox.example.com (10.34.25.23)  11.047 ms  10.882 ms  10.802 ms
 7  somebox.example.com (10.34.25.23)  8.318 ms  7.076 ms  7.016 ms

When * * * should be: 10.34.25.23 (No other devices between 10.72.12.85 and 10.34.25.23)

ping 10.34.25.23
PING 10.34.25.23 (10.34.25.23) 56(84) bytes of data.
64 bytes from 10.34.25.23: icmp_seq=1 ttl=122 time=8.21 ms
64 bytes from 10.34.25.23: icmp_seq=2 ttl=122 time=8.28 ms
64 bytes from 10.34.25.23: icmp_seq=3 ttl=122 time=7.73 ms
64 bytes from 10.34.25.23: icmp_seq=4 ttl=122 time=7.21 ms

**All Addresses have been changed to not reflect the real addresses.

share|improve this question
    
The 4th line is fun, but the 5th and next are more fun, isn't the host reachable? –  LatinSuD Sep 22 '10 at 18:20
    
10.34.25.23 is reachable. –  l0c0b0x Sep 22 '10 at 18:31
    
Does the traceroute complete? I'm guessing there is a routing loop somewhere. Hopefully your traceroute supports the '-q' option, which for me is "the number of probe packets per hop. The default is 3." Try setting that to 1. Try using mtr for more info and tracepath to get an idea of the routing. –  Mark Wagner Sep 22 '10 at 18:48
    
Here is the textual output of tcpdump for this trace . –  Zoredache Sep 22 '10 at 19:38
    
Hmm... Yeah... time exceeded in transit. The TTL is expiring due to a routing loop. –  joeqwerty Sep 22 '10 at 20:46

2 Answers 2

Because the fourth host isn't fully handling ICMP (probably due to security reasons and/or misconfiguration).

Traceroute is based on "ICMP Time Exceeded" responses, which are returned when a ICMP packet exceeds its maximum TTL, so an intermediate router discards it; but a router can be configured not to notify the sender of an expired ICMP packet, even if it replies to a ping (which uses different ICMP packet types).

More info here: http://en.wikipedia.org/wiki/Traceroute

share|improve this answer
    
The fourth host is 10.34.25.23.. yeah, same as the 5th, 6th, and 7th host... that is what's bothering me. –  l0c0b0x Sep 22 '10 at 18:30
    
Woah, totally missed that while looking at the asterisks :-o It looks very much like a routing loop on that host... –  Massimo Sep 22 '10 at 18:45
1  
I agree, it looks like a routing loop to me as well. –  joeqwerty Sep 22 '10 at 19:41

Do we all understand that ping and tracert are fundamentally the same. A ping is an ICMP Echo requset with the TTL set to max for the machine(unless somehow overridden).

Tracert uses the same ICMP request, varying the TTL {1,2,3,4,...max}.

If it weren't for the fact that the ping worked I would agree that there was a routing loop. If there were a routing loop the ping should have failed.

@The OP - Ping 10.102.65.44 so we can see what your default TTL is.

share|improve this answer
    
OP?... From my host to my border router--next hop--(10.52.2.41): TTL=255. From my host to the core router (10.102.65.44): TTL=63 –  l0c0b0x Sep 23 '10 at 16:13
    
What is the TTL if you ping 10.72.12.85? 62? –  dbasnett Sep 23 '10 at 20:39
    
No.. pinging 10.72.12.85, I get a ttl of 253. –  l0c0b0x Sep 23 '10 at 20:58
    
What are the specifics for 10.34.25.23? It looks like after some number of hops within 10.34.25.23 you receive a successful response. If the pattern continues 10.34.25.23 gets an ICMP echo with the TTL set to 252, then 251, 250... until 122 at which it returns a successful response. –  dbasnett Sep 24 '10 at 12:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.