Traceroute
Tuesday, June 17th, 2008Traceroute is a new tool for me. My researches tell me it is used to trace the path of packets across an IP network, and has commonly been used in network troubleshooting. Since I’ve only ever set up my home LAN (with one router and a maximum of four hosts), I’ve not really had call to use it to date.
I like the way traceroute works.: it’s very logical. The program sends out three packets initially with a time-to-live (TTL) value of one (meaning that the packets will make only one “hop” to the next router). The next three packets sent out have a TTL value of two, and so on. When routers receive a packet, they decrement the TTL value by one and forward it to the next router, until the TTL value reaches one. At this point, the router discards the packet and sends an Internet Control Message Protocol (ICMP) time exceeded packet back to the sender. Traceroute uses these ICMP time exceeded messages to trace the path of packets through the network. Or, from the Linux traceroute man page:
traceroute tracks the route packets take across an IP network on their way to a given host. It utilizes the IP protocol’s time to live (TTL) field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to the host.
Pretty cool.
So, to the task. I visited the Lawrence Berkely National Laboratory’s Network Research Group website, where one can obtain a number of network tools, including traceroute, by anonymous FTP. Since traceroute is already installed in my Debian Etch distro, all I did was read through the web page and note the URL.
I then attempted to traceroute from ee.lbl.gov to curtin.edu.au, using the loose source routing option I discovered by running traceroute –help. My results are depicted in the following image:
‘Hhhmmm… that doesn’t look quite right!’, thought I. I looked for information on traceroute output and found:
In the situation, it is likely to be either a router on the path not sending back the ICMP “time exceeded” messages OR a router or firewall in the path blocking the ICMP “time exceeded” messages. An investigation into loose source routing tells me:
In the good old days, you could use source routing with traceroute to see the reverse trace back to you from a host. The idea is to specify what is called a loose source route, which specifies a system your packets should pass through before proceeding on to their destination.
The ability to use loose source routing to see the reverse route could be pretty handy. Unfortunately, source routing has a great potential for abuse, and therefore most network administrators block all source-routed packets at their border routers. So, in practice, loose source routes aren’t going to work.
These days, the only hope you likely have of running a reverse traceroute is if the system you want to trace from has a traceroute facility on their web site. Many systems, and Usenet providers in particular, have a web page where you can run a traceroute from their system back to yours. In combination with your trace to their system, this can give you the other half of the picture. I have a list of Usenet provider traceroute pages here.
So, my results are not unexpected, since most administrators now block source-routing packets at their borders. On to an online tool, as suggested. I headed over to Pingdom Tools, where I got the following results:
Pingdom Tools Traceroute to curtin.edu.au
I then ran a traceroute from my own machine to curtin.edu.au, with the following results:
The IP number for curtin.edu.au is 134.7.179.53.
And just for fun, I ran a traceroute from my machine to another host on my LAN:
I did a little more playing around, checking out tcptraceroute (which sends out TCP SYN packets instead of UDP or ICMP ECHO packets, bypassing the most common firewall filters), but with no greatly different results.
I found this task rather interesting, as I was forced to undertake some investigation in order to complete it and fully understand how the tool operates, including it’s limitations. As with the other tools, the security needs and precautions necessary in the current environment have rendered traceroute less effective (as a network troubleshooting tool, in this case) than in days past.
Resources:
Wikipedia: Traceroute
LBNL’s Network Research Group
Linux Home Networking, Chapter 9, Simple Network Troubleshooting
Using Traceroute
Pingdom Tools
tcptraceroute









