traceroute

The Internet is a large and complex aggregation of network hardware, connected together by gateways. Tracking the route one's packets follow (or finding the miscreant gateway that's discarding your packets) can be difficult. Traceroute utilizes the IP protocol 'time to live' field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host.

The only mandatory parameter is the destination host name or IP number.

Traceroute is a general purpose internet troubleshooting tool available for free on almost all internet connected device. It should be in the bags of tricks of any self respecting internet hacker. You can even traceroute from many places in the world to anywhere else via traceroute servers listed on www.traceroute.org.

Jack Rickard's article in Internetica December 1996, "Mapping the Internet with Traceroute" provides very useful pointers on usage of traceroute.

after http://www.traceroute.org/
http://www.geocities.com/sabre23t/info/traceroute.htm
http://boardwatch.internet.com/mag/96/dec/bwm38.html

Many people have used traceroute in their lives, but it seems like very few know what traceroute actually does or how it works.

Let's look at a normal IPv4 packet. There is a bunch of information in the packet header, one of which is a TTL, or time to live. Originally, every time that a packet was looked at by a router, the router was supposed to decrement the TTL by how many seconds the router "had" the packets. The newer RFC's now say that TTL should be decremented by one every time a router touches the packet.

Okay, now that we've gotten that out of our way, lets explain traceroute. First it finds the IP address of the machine we are trying to traceroute to, then we send a packet to the IP address and set the TTL to 1. So what happens is that the packet tries to route the packet to the first router. The first router sees that the TTL is one, decrements the TTL by one, then sees that the TTL is now zero. The router now sends a ICMP packet back to the source saying that the time exceeded. This gives your traceroute client the first hop. Now change the TTL to two and send the packet. It goes past the first router, it decrements the TTL by one, which makes the TTL now one, and into the next router the packet goes. The TTL is again decremented by 1 by the second router. The router sees this packet now as a TTL of zero, and again sends an ICMP packet back to the source saying that the time exceeded. This continues on until the packet doesn't get returned or the packet gets to it's destination.

Hopefully I've explained this well, but if not, msg me and let me know. Happy tracerouting.