Tag Info

Hot answers tagged

20

!X means "communication administratively prohibited" and !Z "communication with destination host administratively prohibited" As far as I remember, you get !X on ipv4 and !Z on ipv6 and it should be documented in the man (8) pages. Since Linux uses UDP for trace-routes, this can originate from a --reject-with icmp-host-prohibited rule at the destination. ...


18

Traceoute requires a response from the target server and each of the intermediate hops to create its output. If a router doesn't generate a Time-to-live exceeded response, traceroute will not know anything about that hop. A hop that outputs * * * means that the router at that hop doesn't respond to the type of packet you were using for the traceroute (by ...


16

If you block some ICMP traffic, for firewalling or whatever reason, then traceroutes don't fully work. They're a mixture of UDP (the DNS lookups) and ICMP usually. If you run traceroute -I yahoo.com or traceroute -T yahoo.com you should see different results (yahoo.com completes for me). This uses ICMP echo and TCP SYNs. From the traceroute command's man ...


15

Parallelism is a major reason for variation in the speed of these tools. Another contributing factor is how long they wait for a reply before the hop is considered to not be responding. If reverse DNS is performed, you have to wait for that as well. The plain traceroute command gets much quicker, if you disable reverse DNS. Another important difference, ...


14

Traceroute uses groups of ICMP messages. each has 3 ICMP messages. (HOP count increment by one in each group of messages). Usually admins block ICMP packets to "protect" their network. (mostly to obscure the structure of network and DoS). That's why you get stars.


14

This is an effect of Content delivery network (CDN) http://en.wikipedia.org/wiki/Content_delivery_network Akamai is one of the biggest CDN. Explain: CDN have a lot of servers around the world, which serves as caching reverse proxy (this is not a proxy for user; but a proxy just before to server, to lower number of request). To make access to site faster, ...


13

The type of packet that is sent differs depending on the implementation. By default Windows tracert uses ICMP and both Mac OS X and Linux traceroute use UDP. I don't have BSD or Solaris machines or any other OS on hand to check but the man page for the Mac OS X version mentions its provenance is BSD 4.3. The Mac and Linux versions I have offer the ability ...


12

Found the solution: Do you have CSF installed? If yes, open the config page for CSF and search the page for traceroute. There you'll see this message: # Allow outgoing UDP ports # To allow outgoing traceroute add 33434:33523 to this list


11

You cant just add together all of those numbers. That is the ping time to each of the hops on the path to google. So natually each leg of the path gets farther and farther away and you see varying ping times. If you look at the last ping time in tracert (34 ms) and the time you received when you issued the ping (34ms) these are the same. The tracert program ...


11

All implementations of traceroute rely on ICMP (type 11) packets being sent to the originator. This program attempts trace route by launching UDP probe packets with a small ttl (time to live) then listening for an ICMP "time exceeded" reply from a gateway. It starts probes with a ttl of one and increase by one until we get an ICMP "port unreachable" ...


10

RFC1918 addresses (10/8, 172.16/12 and 192.168/16) should not appear in global routing tables, as they're designed to be used within "a single enterprise". However, it makes sense, to some extent, using RFC1918 addresses for your point-to-point links within your core, even if the traffic going across those links are for "globally routable" IP address ranges, ...


10

RTT is "round-trip time", it's the delay between sending the packet and getting the response; the *s mean that the timeout was reached before getting a response. Three numbers are provided from three different packets to give you a better sampling of the delay to that host.


8

In my experience, many programmers don't understand what ping is and what it is not. I have often encountered those who think that if they can ping a thing, they can then use X service running on that thing. And there are also those who think that if they can't ping it, then they can't use it. Both assumptions are false. That being said, we can't restrict ...


8

You can see the ping like a drive from New York to San Francisco. It takes, lets say 200 hours (im from switzerland and not familiar with the distances in the US) But the Driver has to come back to New York to tell you that he was in San Francisco. You take a look to the watch and now you calculate that he took 400hours for the distance. Now that is what ...


8

It has nothing to do with the wall-clock time on the systems involved. Whatever system you're doing the traceroute from knows when it sent the ICMP request, and knows when it received the reply. It can then calculate how long the reply took to arrive.


8

How about MTR? # mtr -r serverfault.com HOST: gentoo Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.0.1 0.0% 10 0.9 1.2 0.9 1.6 0.3 2.|-- 192.168.1.1 0.0% 10 1.9 2.2 1.6 4.1 0.7 3.|-- localhost 20.0% 10 28.3 48.5 6.5 98.6 30.0 | `|-- ...


8

Such pings are useful for: Discovering how sizes affect latencies Discovering packet reassembly issues With no-fragment set, discovering faults in MTU detection On wireless networks: Discover the effect of packet size on fragmentation settings Providing a consistent source of traffic to do RF analysis


8

No. The hops shown by traceroute show the path that an IP packet follows on a routed (layer 3) network. Routers will show up, and switches will not. Switches are by their nature a layer 2 device: they receive and forward Ethernet frames, using the destination MAC address to determine the correct destination port. Some switches are also able to function as ...


7

You're reading the traceroute backwards. Every traceroute has a FIRST HOP of nameitellegence.com which is just the next-hop router from domaintools.com. in your example, the last hope router is: pw-in-f99.1e100.net So it's going Domain Tools -> nameinstellegence router -> ... routers ... -> Last hop router.


7

That's because Windows and Linux implement traceroute differently. On Windows, it uses ICMP Echo packets with varying time-to-live settings to figure out intermediary hops. On Linux, it uses UDP packets with varying time-to-live settings to figure out intermediary hops. Some networks allow one or both, or none. Networks that allow ICMP but not UDP will ...


7

MPLS is well known to mangle Traceroute results: http://www.cisco.com/en/US/tech/tk436/tk428/technologies_tech_note09186a008020a42a.shtml


7

A router's job is to route packets. It's not a ping responder. It can route packets just fine even if it can't respond to pings. Since you're seeing latency of less than a hundredth of a second to the hop after it and no packet loss, I'd say it's routing just fine. How can hop 7 be smaller than 6 and 8 smaller than 7 and 6!?? Shouldn't the pings be ...


6

You can try querying the ripe database http://www.db.ripe.net/whois


6

I tend to use winmtr for this.


6

My best guess is your Wireless router isn't actually routing but bridging so it wouldn't show up on a traceroute.


6

The packet loss is not necessary an indication of a problem. Remember those are attempts to communicate with that particular network node directly. Usually those in-between router nodes are only responsible for passing traffik through to another location. They are not required to chat with you directly at all, and one that drops most of your chat should not ...


6

My suggestion would be to test against a node at the ISP, preferrably the remote end of your circuit/connection. Anything upstream from the ISP is beyond their control and irrelevant to the problem (meaning there's nothing they can do about upstream packet loss or packet loss that isn't occurring on their network). In addition, ping isn't a good tool for ...


6

Traditional traceroute uses UDP on incrementing ports for every hop. You can use any sort of packet to implement it - ICMP, TCP SYN, etc. All it takes is the IP packet expiring and you are golden. Various implementations, like MacOS, offer support for multiple types of traceroute, as well as modes that don't increment ports, etc, to bypass firewall ...


5

I'm not convinced that this doesn't belong on meta, but it's a slow morning, so what's the harm? ping, particularly, is one of those tools that has a low barrier of entry and provides a high degree of usefulness for a small amount of effort. It's also one of the first diagnostic tools that someone learns in networking. This means that a lot of people of ...


5

In 99% of cases, the penultimate hop of a traceroute will not be the default gateway of the destination host. This is because of the way that traceroute works. All IP packets have a -somewhat misnamed- time-to-live (TTL) field. This field is decremented by one by every router that forwards a packet. If a router decrements the TTL to 0, it drops the packet ...



Only top voted, non community-wiki answers of a minimum length are eligible