What Are Traceroutes and How Do They Work?

Jean-François Lévesque
Jean-François Lévesque Last updated on Aug. 4, 2020

What Are Traceroutes and How Do They Work?

We have written a series of articles about traceroutes, the most popular tool that network engineers use to troubleshoot network performance.

What Are Traceroutes and How Do They Work?
What Are Traceroutes and How Do They Work?

Let’s start the traceroutes series with this introduction to traceroutes and more details about how they actually work.

What are traceroutes?
What are traceroutes?

Traceroute is the most popular tool that network engineers use to troubleshoot networks. It was invented in 1987 and is still highly relevant today. As its name suggests, the main purpose of a traceroute is to trace the IP route from a source to a destination inside an IP network. It shows to the user the routers but also the round-trip latency from the source to each of the routers. Traceroute commands are available on almost any host. On Windows, there is the tracert.exe command and on Linux and MacOS it’s the traceroute command. There are other free and commercial software that do traceroutes such as the Obkio Monitoring Agent. Here is an example from Obkio Live Traceroute feature:

+---+-------------------+-------+-----+------+------+------+------+
| # | Hostname          | Loss% | Snt | Last |  Avg | Best | Wrst |
+---+-------------------+-------+-----+------+------+------+------+
| 1 | 192.168.1.1       |   0.0 |  20 |  4.3 |  1.5 |  0.4 |  4.3 |
| 2 | router1.ispA.com  |   0.0 |  20 |  6.8 | 15.4 |  6.8 | 35.9 |
| 3 | router2.ispB.com  |   0.0 |  20 | 12.3 | 13.7 |  8.4 | 28.1 |
| 4 | router3.ispC.com  |   0.0 |  20 | 11.3 | 13.8 |  9.0 | 38.4 |
| 5 | website.com       |   0.0 |  20 | 12.8 | 16.1 | 10.4 | 38.4 |
+---+-------------------+-------+-----+------+------+------+------+

It's important to understand that traceroutes will only trace Layer 3 IP Routers or Hosts. If there is a switch or wifi access point between two routers, a traceroute will not show them even if they have a management IP to access them. A switch with Layer 3 / IP routing features will appear only if it is routing the packets.

How does a traceroute work?
How does a traceroute work?

In the IP Header, there is an 8-bit field called Time-to-live (TTL) that goes from 0 to 255. The value of the TTL is decremented by 1 each time a packet is routed by a router. When the TTL value is 0, the packet is discarded and an ICMP TTL Exceeded message might be sent back to the source of the packet.

The main objective of the TTL field is not to trace a route but to discard packets if there is a routing loop in a network. So if there is a loop, since each router decrements the TTL value, at one point, it goes to 0 and gets discarded.

So the traceroute software uses the TTL to discover the routers between a source and a destination.

figure A - Figure A - What are Traceroutes

Here’s how it works…
Here’s how it works…

You can follow along with the picture above to get a better understanding.

  1. Firstly, the Source (Src) sends a packet with TTL=1.

  2. The Router decrements the TTL by 1, which changes the value to 0. The packet is dropped and the router sends an ICMP TTL Exceeded message. The destination IP address for the ICMP message equals the source IP address of the discarded packet. The source IP address of the discarded packet is the IP address of the interface on which the packet was received.

  3. The Source receives the "ICMP TTL Exceeded" message and adds the router IP to the Traceroute hops table.

  4. Then the process starts over again with TTL=2.

  5. The packet is routed through the first Router (R1), which also decrements the packet value.

  6. The second Router (R2) receives the packet, decrements the TTL, discards the packet and sends the "ICMP TTL Exceeded" message.

  7. And it continues like this by incrementing the TTL by 1 until it reaches its destination.

What if the router doesn't respond?
What if the router doesn't respond?

The latency measured for each router in the trace is the time difference between when the message is sent and when the TTL exceeded message is received. It's important to note that there is no obligation for the router to send that ICMP TTL Exceeded message. So if a router never sends the message, it will not be discovered in the traceroute, but since it is still decrementing the TTL value, it will count as an unknown hop in the trace. Here is an example with hop #3 not sending ICMP TTL Exceeded packets:

+---+-------------------+-------+-----+------+------+------+------+
| # | Hostname          | Loss% | Snt | Last |  Avg | Best | Wrst |
+---+-------------------+-------+-----+------+------+------+------+
| 1 | 192.168.1.1       |   0.0 |  20 |  4.3 |  1.5 |  0.4 |  4.3 |
| 2 | router1.ispA.com  |   0.0 |  20 |  6.8 | 15.4 |  6.8 | 35.9 |
| 3 | ???               | 100.0 |  20 |    - |    - |    - |    - |
| 4 | router3.ispC.com  |   0.0 |  20 | 11.3 | 13.8 |  9.0 | 38.4 |
| 5 | website.com       |   0.0 |  20 | 12.8 | 16.1 | 10.4 | 38.4 |
+---+-------------------+-------+-----+------+------+------+------+

Next Traceroute Articles
Next Traceroute Articles

This is the end of this first article on traceroutes. The next articles will cover how to analyze traceroutes and which information is the most important.

We hope you enjoyed this article in the traceroute series.

Related Blog Categories:
Traceroutes