traceroute(1)traceroute(1)NAMEtraceroute - print the route packets take to network host
SYNOPSIS
first_ttl ] addr ] iface ] max_ttl ] port ] nqueries ] src_addr] tos ]
waittime ] host [ packetsize ]
DESCRIPTION
The Internet is a large and complex aggregation of network hardware,
connected together by gateways. Tracking the route one's packets fol‐
low (or finding the miscreant gateway that's discarding your packets)
can be difficult. utilizes the IPv4 protocol `time to live' or IPv6
'hop limit' field and attempts to elicit an ICMPv4 TIME_EXCEEDED or
ICMPv6 TIME_EXCEEDED response from each gateway along the path to some
host.
The only mandatory parameter is the destination host name or IPv4/IPv6
number. The default probe datagram length is 40 bytes, but this may be
increased by specifying a packet size (in bytes) after the destination
host name.
Other options are: Force to switch in IPv6 mode. By default, if the
name of a host is provided, not the literal IPv4/IPv6 address, and a
valid IPv4 address exists in the name service database, will use this
address. Otherwise, if the name service database contains an IPv6
address, it will try the IPv6 address.
Enable socket level debugging.
Set the initial IPv4 time-to-live or IPv6 hop-limit used in the first
outgoing
probe packet to n hops. The default is 1 hop.
(IPv4 only) Set the "don't fragment" bit in the packet header.
The packets may be sent with this flag set anyway, but this
forces it to be always set. This flag prevents forwarding gate‐
ways from fragmenting the probe packets if an intermediate hop
has a maximum packet size (also known as a Maximum Transmission
Unit size or MTU size) smaller than the size of the probe
packet. Used in conjunction with the packetsize argument, this
option can be used to determine the maximum size packet which
can travel to the specified destination without being frag‐
mented.
Enable the IPv4 LSRR (Loose Source and Record Route) or IPv6 intermedi‐
ate
gateway option in addition to the TTL tests. This is useful for
asking how somebody else, at IPv4/IPv6 address addr, reaches a
particular target.
Specify a network interface to obtain the source IPv4 or IPv6 address
for
outgoing probe packets. This is normally only useful on a
multi-homed host. (See the flag for another way to do this.)
(IPv4 only) Use ICMPv4 ECHO instead of UDP datagrams.
Set the max time-to-live (max number of hops) used in outgoing probe
packets to n hops. The default is 30 hops (the same default
used for TCP connections).
Print hop addresses numerically rather than symbolically and numeri‐
cally
(saves a nameserver address-to-name lookup for each gateway
found on the path).
Set the base UDP port number used in probes (default is 33434).
hopes that nothing is listening on UDP ports base to at the des‐
tination host (so an ICMPv4 or ICMPv6 PORT_UNREACHABLE message
will be returned to terminate the route tracing). If something
is listening on a port in the default range, this option can be
used to pick an unused port range.
Set the number of queries (probes) that will be sent with each
given time-to-live or hop-limit value. The default is 3.
Bypass the normal routing tables and send directly to a host on an
attached
network. If the host is not on a directly-attached network, an
error is returned. This option can be used to ping a local host
through an interface that has no route through it (e.g., after
the interface was dropped by routed(8C)).
Use the IPv4 or IPv6 address
addr (which usually is given as an IPv4/IPv6 number, not a host‐
name) as the source address in outgoing probe packets. On hosts
with more than one IPv4/IPv6 address, this option can be used to
force the source address to be something other than the
IPv4/IPv6 address of the interface the probe packet is sent on.
If the IPv4/IPv6 address is not one of this machine's interface
addresses, an error is returned and nothing is sent. (See the
flag for another way to do this.)
(IPv4 only) Set the
type-of-service in probe packets to the following value (default
zero). The value must be a decimal integer in the range 0 to
255. This option can be used to see if different types-of-ser‐
vice result in different paths. (If you are not running 4.4BSD,
this may be academic since the normal network services like and
don't let you control the TOS). Not all values of TOS are legal
or meaningful - see the IP spec for definitions. Useful values
are probably (low delay) and (high throughput).
Verbose output. Received ICMPv4 or ICMPv6 packets other
than TIME_EXCEEDED and UNREACHABLEs are listed.
Set the time (in seconds) to wait for a response to a probe to
n (default 5 sec.).
Toggle checksums. Normally, this prevents traceroute from calculating
checksums. In some cases, the operating system can overwrite
parts of the outgoing packet but not recalculate the checksum
(so in some cases the default is to not calculate checksums and
using causes them to be calculated). Note that checksums are
usually required for the last hop when using ICMPv4 ECHO probes
Note: On a multi-homed host, if is invoked without the or options, the
source address used for the probe packets may not be the same as the
address of the interface through which they are sent out. As a result,
the destination or the next hop may not be able to reply to the probe
and traceroute(1) may not display the route to the destination prop‐
erly. Thus, in the multi-homed host case, use the or options to
explicitly specify the appropriate source address for probes.
This program attempts to trace the route an IPv4/IPv6 packet would fol‐
low to some internet host by launching UDP probe packets with a small
(time to live) or hop-limit then listening for an ICMPv4 or ICMPv6
"time exceeded" reply from a gateway. We start our probes with a of
one and increase by one until we get an ICMPv4 or ICMPv6 "port unreach‐
able" (which means we got to "host") or hit a max (which defaults to 30
hops and can be changed with the flag). Three probes (change with
flag) are sent at each setting and a line is printed showing the
address of the gateway and round trip time of each probe. If the probe
answers come from different gateways, the address of each responding
system will be printed. If there is no response within a 5 second
timeout interval (changed with the flag), a is printed for that probe.
We don't want the destination host to process the UDP probe packets so
the destination port is set to an unlikely value (if some process on
the destination is using that value, it can be changed with the flag).
A sample use and output might be:
[yak 71]% traceroute nis.nsf.net.
traceroute to nis.nsf.net (35.1.1.48), 30 hops max, 38 byte packet
1 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms
2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms
3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms
4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms
5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms
6 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms
7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms
8 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms
9 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms
10 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms
11 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms
Note that lines 2 and 3 are the same. This is due to a buggy kernel on
the second hop system that forwards packets with a zero (a bug in the
distributed version of 4.3BSD). Note that you have to guess what path
the packets are taking cross-country since the NSFNet (129.140) doesn't
supply address-to-name translations for its NSSes.
A more interesting example is:
[yak 72]% traceroute allspice.lcs.mit.edu.
traceroute to allspice.lcs.mit.edu (18.26.0.115), 30 hops max
1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms
2 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms
3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms
4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms
5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms
6 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms
7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms
8 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms
9 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms
10 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms
11 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms
12 * * *
13 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms
14 * * *
15 * * *
16 * * *
17 * * *
18 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms
Note that the gateways 12, 14, 15, 16 and 17 hops away either don't
send ICMPv4 "time exceeded" messages or send them with a too small to
reach us. 14 - 17 are running the MIT C Gateway code that doesn't send
"time exceeded"s. It is unclear what's going on with 12.
The silent gateway 12 in the above may be the result of a bug in the
4.[23]BSD network code (and its derivatives): sends an unreachable mes‐
sage using whatever remains in the original datagram. Since, for gate‐
ways, the remaining is zero, the ICMPv4 "time exceeded" is guaranteed
to not make it back to us. The behavior of this bug is slightly more
interesting when it appears on the destination system:
1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms
2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms
3 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms
4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms
5 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms
6 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms !
Notice that there are 12 "gateways" (13 is the final destination) and
exactly the last half of them are "missing". What's really happening
is that (a Sun-3 running Sun OS3.5) is using the from our arriving
datagram as the in its ICMPv4 reply. So, the reply will time out on
the return path, and because ICMPv4's are not generated for ICMPv4
replies, no one would get a notice of the reply until we probe with a
that's at least twice the path length; i.e., is really only 7 hops
away. A reply that returns with a of 1 is a clue this problem exists.
prints a after the time if the is Since vendors ship a lot of obsolete
(DEC's Ultrix, Sun 3.x) or other non-standard software, expect to see
this problem frequently and/or take care picking the target host of
your probes.
Other possible annotations after the time are or (got a host, network
or protocol unreachable, respectively), or (source route failed or
fragmentation needed - neither of these should ever occur and the asso‐
ciated gateway is busted if you see one), (communication administra‐
tively prohibited), or (ICMPv4 unreachable code N). If almost all the
probes result in some kind of unreachable, will give up and exit.
This program is intended for use in network testing, measurement and
management. It should be used primarily for manual fault isolation.
Because of the load it could impose on the network, it is unwise to use
during normal operations or from automated scripts.
AUTHOR
Implemented by Van Jacobson from a suggestion by Steve Deering.
Debugged by a cast of thousands with particularly cogent suggestions or
fixes from C. Philip Wood, Tim Seaver and Ken Adelman.
SEE ALSOnetstat(1), ping(1M).
traceroute(1)
