Introduction to Traceroute
Traceroute is a network diagnostic tool found on most operating systems, which is used for determining which path a packet has taken. The traceroute command can be used to draw up a map of the routers found between a source machine and a target machine. The traceroute command is different on each operating system.
Output of a traceroute
A traceroute's output describes the names and IP addresses of the chain of routers, each preceded by a sequential number and minimum, average, and maximum response time.
Tracing a route to www.commentcamarche.net [126.96.36.199]
over a maximum of 30 hops:
1 33 ms 32 ms 33 ms raspail-2-81-57-234-254.fbx.proxad.net [188.8.131.52]
2 33 ms 33 ms 33 ms vlq-6k-2-a5.routers.proxad.net [184.108.40.206]
3 33 ms 33 ms 33 ms vlq-6k-2-v802.intf.routers.proxad.net [220.127.116.11]
4 33 ms 33 ms 33 ms th1-6k-2-v806.intf.routers.proxad.net [18.104.22.168]
5 32 ms 34 ms 34 ms cbv-6k-2-v802.intf.routers.proxad.net [22.214.171.124]
6 34 ms 32 ms 33 ms ldc-6k-1-a0.routers.proxad.net [126.96.36.199]
7 35 ms 35 ms 35 ms cogent.FreeIX.net [188.8.131.52]
8 36 ms 36 ms 35 ms NeufTelecom.demarc.cogentco.com [184.108.40.206]
9 36 ms 36 ms 36 ms V3994.c1cbv.gaoland.net [220.127.116.11]
10 34 ms 34 ms 35 ms V4080.core3.cbv.gaoland.net [18.104.22.168]
11 36 ms 35 ms 37 ms 22.214.171.124
12 36 ms 36 ms 36 ms nestor.commentcamarche.net [126.96.36.199]
How a traceroute works
Traceroute works thanks to the TTL field in IP packets. Each IP packet has a time to live field (TTL) which is reduced each time it goes through a router When this field reaches zero, the router determines that the packet has been going around in circles, terminates this packet and sends an ICMP notification to the sender.
For this reason, traceroute sends packets to an unprivileged UDP port which is believed to be unused (port 33434 by default) with a TTL set to 1. The first router encountered will delete the packet and send an ICMP packet which includes the IP address of the router as well as the loop delay. Traceroute then increases the TTL field by 1 at a time, so as to obtain a reply from each router on the pathway, until it gets the reply "ICMP port unreachable" from the target machine.