Most implementations of “trace” will send several probe packets at each TTL, and display the round-trip time for each. For example, Cisco IOS and MS Windows do three probes per hop by default. The display then resembles a table with a row for each hop, and the columns are hop number, the round-trip times, and the router address at that hop. If DNS or host table info is available, the trace program can also supply the hostname of the device at each hop.

When we left off, we were two hops into a trace from H1 to H2. Now H1 sends a probe packet towards H2 with the IP TTL set to three, and starts the timer. When the probe packet arrives at R1, it will decrement the TTL to two and forward the packet towards H2. The probe packet will then reach R2 with a TTL of two. When the probe packet arrives at R2, it will decrement the TTL to one and forward the packet towards R3. The probe packet will then reach R3 with a TTL of one.

When the probe packet arrives at R1, per RFC 1812 (section 5.3.1), that router will decrement the packet’s IP TTL. Since the TTL in the probe packet was one, after being decremented the TTL will be zero, and R1 will discard the probe packet. The RFC also specifies that the router should send a packet containing an ICMP “TTL Exceeded” message (TEM) back to the originating host. This is a key part of the operation of the trace utility, so let’s take a closer look at this. When R1 sends the TEM packet back to H1, it sets the destination address of the TEM packet to H1’s IP address (the source address of the probe packet), but to what does it set the TEM packet’s source address?

Ever seen a /32 prefix in the IP routing table? A /32 prefix is commonly referred to as a host route since it identifies a route to a specific IP host address. Since most (but not all) host computers don’t run routing protocols, we could create a host route on a router and then advertise […]