Certopolis

CompTIA Network+ (V9)

How ping and traceroute work (ICMP) for Network+

Traceroute sends probes with a TTL that starts at 1 and rises by one, and each router that drops a probe at TTL zero may return ICMP Time Exceeded. Windows tracert uses ICMP echo requests; classic Linux traceroute uses UDP to an unlikely port, so the destination ends the trace with ICMP port unreachable. Ping uses ICMP echo, and with the Don't Fragment flag set it can show a path MTU problem.

The ICMP messages involved

RFC 792 defines Time Exceeded, code 0, time to live exceeded in transit. If a gateway finds the TTL is zero, it must discard the datagram and may tell the source with this message.

RFC 792 also defines Destination Unreachable, with codes including 0 net unreachable and 3 port unreachable. A destination host may send port unreachable when the port a datagram is aimed at is not active.

RFC 1812 says a router with no route at all to a destination, including no default route, must send Destination Unreachable code 0, network unreachable.

tracert versus traceroute

Microsoft's tracert reference says it sends ICMP echo Request (or ICMPv6) messages, starting with a TTL of 1 and adding 1 each time, until the target responds or the hop limit is reached. The default maximum is 30 hops, set with /h. The /d option stops it resolving router names, which speeds up results.

The Linux traceroute man page says the default method sends UDP datagrams to an unlikely destination port, starting at 33434. Three probes are sent per TTL by default, up to 30 hops. The trace ends when an ICMP port unreachable comes back from the host itself. -I uses ICMP echo and -T uses TCP instead, which can help where firewalls drop the UDP probes.

In Linux output, * means no reply to that probe within the timeout. After the times, !H, !N or !P means host, network or protocol unreachable, !F means fragmentation needed, and !X means communication administratively prohibited.

Reading the results

RFC 1812 explains that the TTL's hop-count role stops routing problems from making packets loop forever. If a trace shows the same two router addresses alternating hop after hop, each router is sending the packet back to the other: a routing loop.

A line of asterisks at one hop, with later hops answering, usually means that router does not send Time Exceeded, not that the path is broken.

To test path MTU, set the Don't Fragment flag: ping /f on Windows, or ping -M do on Linux. A router that cannot forward the packet whole then drops it instead of fragmenting it, so the ping fails at sizes the path cannot carry. Windows ping sends 4 echo requests by default (/n changes it); Linux ping uses -c for the count.

Where the exam catches people

  • Believing Windows tracert uses UDP: it sends ICMP echo requests; classic Linux traceroute sends UDP to an unlikely port.
  • Believing the final hop of a UDP traceroute sends Time Exceeded: the destination host replies with ICMP port unreachable.
  • Believing an asterisk means the hop is down: it means no reply to that probe within the timeout.
  • Believing two addresses repeating in a trace is load balancing: alternating addresses up to the hop limit indicate a routing loop.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A UDP-based traceroute stops because the final reply comes from the target host itself rather than from a router. Which of the following ICMP messages did the target send?

    Right. In the game that’s Renown for your Network Troubleshooting building.

    Not that one: B is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    UDP traceroute aims at an unlikely port precisely to provoke this reply from the final host.

    Written from www.rfc-editor.org/rfc/rfc792.html

  2. A traceroute to a remote server shows the same two router addresses alternating hop after hop until the trace gives up. Which of the following is the most likely cause?

    Right. In the game that’s Renown for your Network Troubleshooting building.

    Not that one: A is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The TTL's hop-count role exists 'to ensuring that routing problems can't melt down the network by causing packets to loop infinitely'. Two routers answering alternately for ever-higher TTLs means each is forwarding the packet to the other: a routing loop.

    Written from www.rfc-editor.org/rfc/rfc1812.html

  3. A technician suspects a path cannot carry full-size packets and wants ping to fail rather than have its packets split by a router along the way. Which of the following should ping be told to do?

    Right. In the game that’s Renown for your Network Troubleshooting building.

    Not that one: D is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    With the Don't Fragment flag set, a router that cannot forward the packet whole must drop it and signal 'fragmentation needed', so a too-small MTU on the path shows up as a failed ping instead of being hidden by fragmentation.

    Written from man7.org/linux/man-pages/man8/ping.8.html