Any ideas why a tracert (traceroute) to an external host would return with the following:


 1  myborderouter.example3.com (  1.113 ms  1.103 ms  1.100 ms
 2  ae0--931.maincorerouter.example2.com (  4.028 ms  4.046 ms  4.042 ms
 3  gi0-1.mainrouter.example2.com (  6.653 ms  6.661 ms  6.645 ms
 4  * * *
 5  somebox.example.com (  7.361 ms  7.339 ms  8.723 ms
 6  somebox.example.com (  11.047 ms  10.882 ms  10.802 ms
 7  somebox.example.com (  8.318 ms  7.076 ms  7.016 ms

When * * * should be: (No other devices between and

PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=122 time=8.21 ms
64 bytes from icmp_seq=2 ttl=122 time=8.28 ms
64 bytes from icmp_seq=3 ttl=122 time=7.73 ms
64 bytes from icmp_seq=4 ttl=122 time=7.21 ms

****All Addresses have been changed to not reflect the real addresses.**

  • The 4th line is fun, but the 5th and next are more fun, isn't the host reachable? – LatinSuD Sep 22 '10 at 18:20
  • is reachable. – l0c0b0x Sep 22 '10 at 18:31
  • Does the traceroute complete? I'm guessing there is a routing loop somewhere. Hopefully your traceroute supports the '-q' option, which for me is "the number of probe packets per hop. The default is 3." Try setting that to 1. Try using mtr for more info and tracepath to get an idea of the routing. – Mark Wagner Sep 22 '10 at 18:48
  • Here is the textual output of tcpdump for this trace . – Zoredache Sep 22 '10 at 19:38
  • Hmm... Yeah... time exceeded in transit. The TTL is expiring due to a routing loop. – joeqwerty Sep 22 '10 at 20:46

Because the fourth host isn't fully handling ICMP (probably due to security reasons and/or misconfiguration).

Traceroute is based on "ICMP Time Exceeded" responses, which are returned when a ICMP packet exceeds its maximum TTL, so an intermediate router discards it; but a router can be configured not to notify the sender of an expired ICMP packet, even if it replies to a ping (which uses different ICMP packet types).

More info here: http://en.wikipedia.org/wiki/Traceroute

  • The fourth host is yeah, same as the 5th, 6th, and 7th host... that is what's bothering me. – l0c0b0x Sep 22 '10 at 18:30
  • Woah, totally missed that while looking at the asterisks :-o It looks very much like a routing loop on that host... – Massimo Sep 22 '10 at 18:45
  • 1
    I agree, it looks like a routing loop to me as well. – joeqwerty Sep 22 '10 at 19:41

Do we all understand that ping and tracert are fundamentally the same. A ping is an ICMP Echo requset with the TTL set to max for the machine(unless somehow overridden).

Tracert uses the same ICMP request, varying the TTL {1,2,3,4,...max}.

If it weren't for the fact that the ping worked I would agree that there was a routing loop. If there were a routing loop the ping should have failed.

@The OP - Ping so we can see what your default TTL is.

  • OP?... From my host to my border router--next hop--( TTL=255. From my host to the core router ( TTL=63 – l0c0b0x Sep 23 '10 at 16:13
  • What is the TTL if you ping 62? – dbasnett Sep 23 '10 at 20:39
  • No.. pinging, I get a ttl of 253. – l0c0b0x Sep 23 '10 at 20:58
  • What are the specifics for It looks like after some number of hops within you receive a successful response. If the pattern continues gets an ICMP echo with the TTL set to 252, then 251, 250... until 122 at which it returns a successful response. – dbasnett Sep 24 '10 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.