Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some questions about why traceroute doesn't works in some condition. Though I understand how it works, I can't figure out some questions. Like,

 1  * * *
 2  * * *

There are '*'. When I use ICMP stead for UDP, I got those below:

$traceroute -I
 1  * * *
 2  * * *
 3 (  7.980 ms  10.785 ms  4.920 ms
 4 (  4.363 ms  8.141 ms  5.849 ms
 5  bogon (  7.957 ms  7.787 ms  8.321 ms
 6 (  25.341 ms  24.895 ms  28.725 ms
 7 (  23.738 ms  24.172 ms  23.916 ms
 8 (  23.096 ms  24.539 ms  20.827 ms
 9 (  58.516 ms  60.035 ms  63.200 ms
10 (  60.991 ms  59.520 ms  59.853 ms
11 (  59.771 ms  59.192 ms  59.072 ms
12 (  89.185 ms  87.928 ms  89.582 ms
13 (  102.195 ms  103.409 ms  106.153 ms
14 (  218.816 ms  224.845 ms  218.470 ms
15 (  212.560 ms  208.640 ms *
16 (  210.655 ms *  216.369 ms

I wonder why the first and second hop is still unknown. I have tried to set icmp rate with -z 500, but it's useless. So my questions are below:

  1. Why did I get some hops while I use ICMP?
  2. How can I get the first two hops?

I have searched for that, but I got nothing useless. I connect to the Internet through a route without any firewall. Thank you for your help.

share|improve this question

migrated from Nov 20 '11 at 16:21

This question came from our site for professional and enthusiast programmers.

I don't know much about networking, but maybe the two first hops don't return any information, even thought the time to live of the packet is zero when they get it, and just simply drop it? Anyway, this question should probably be moved to Superuser or Server Fault, there's probably more people knowing about these things in those sites... – esaj Nov 20 '11 at 14:48
It means that the first two hops did not provide an ICMP reply, and that the ICMP echo request has timed out. Also, keep in mind that the information is historical, it may or may not reflect the current state of the network, and may or may not reflect the path 'real' data might take. – dbasnett Nov 24 '11 at 14:13

As the Traceroute is based on ICMP Echo requests, then it seems like the first two routes in your way (probably your own premises firewalls) are configured to Drop/Block ICMP echo requests. Thats is why Traceroute is unable to see the actual response from the first two, but proper response beyond that.

share|improve this answer
I think it's possible my route doesn't send any 'time exceeded' ICMP message. When I tried to traceroute to the gateway, it would get response immediately. – robotment Nov 21 '11 at 8:13

The first hop is your gateway to the internet, you can see that with netstat -rn.

The second hop is the gateway at your provider, if you happen to have something like a Fritzbox, you can see the ip-address there.

share|improve this answer
Maybe my route doesn't send 'time exceeded' message. When I type 'traceroute', it will get the response immediately. Thank you any way. – robotment Nov 21 '11 at 8:14

In order to complete the next-hop discovery you can use another tool : hping. As the previous response of Franck explain, there is probably a firewall or router that drop the kind of ICMP message.

For example, you can use this command for the first next-hop:

hping -p 86 -S -t 1

An also this one for see the second:

hping -p 86 -S -t 2
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.