How does traceroute discover the path followed by a packet?
Interview preparation resource from Gate Smashers.
Traceroute discovers a path by sending probe packets with successively larger IPv4 TTL values, or IPv6 Hop Limits. Each router decrements this value when forwarding a packet. When a probe expires at a router, that router normally discards it and returns an ICMP Time Exceeded message. Traceroute uses the reply’s source address and timing to identify that hop and measure an approximate round-trip time. It increases the TTL/Hop Limit one hop at a time until the destination responds or the configured maximum hop count is reached.
TTL and Hop Limit mechanism
IPv4 TTL and IPv6 Hop Limit prevent packets from circulating indefinitely. A router reduces the value as it forwards a packet. If the value expires at that router, the router discards the packet and normally sends an ICMP Time Exceeded response to the source.
Traceroute deliberately uses this behavior to make probes expire at progressively more distant routers.
How hops are discovered
Traceroute first sends a probe with TTL or Hop Limit set to 1. The first router causes the probe to expire and, if it sends an ICMP Time Exceeded response, appears as the first hop.
It then sends probes with values of 2, 3, and higher. A value of 2 allows the first router to forward the probe, while the second router normally returns the Time Exceeded message. Repeating this process reveals responding routers along the forward path.
- Hop address: The source address of the ICMP reply is displayed as the responding hop.
- Delay: The elapsed time between sending a probe and receiving its reply is reported as an approximate round-trip time.
Reaching the destination and probe types
The destination is considered reached when it returns a response appropriate to the probe type. Traditional UDP-based traceroute commonly elicits an ICMP Port Unreachable response from the destination, while ICMP Echo probes can elicit an Echo Reply. TCP-based probes may receive a TCP response from the destination.
Probe formats vary by traceroute implementation and configuration. Common choices are UDP, ICMP Echo Request, and TCP probes; this choice can affect how networks and firewalls handle the probes.
Missing replies and limitations
A timeout, often displayed as an asterisk, means that no expected response was received before the timeout. It does not prove that the router or path has failed: a router may rate-limit or suppress ICMP Time Exceeded messages, or a firewall may filter the probe or reply.
Traceroute shows routers that respond to its probes, not necessarily every forwarding device. Also, the reverse path taken by ICMP replies may differ from the forward path followed by the probes.