CCNP ENCOR // Traceroute // ENCOR 350-401 Complete Course

Traceroute: A Tool for Troubleshooting Network Reachability

In this video, we will learn about traceroute, a tool used to trace the path from source to destination. We will cover how it works and its limitations. We will also look at traceroute on two different platforms: Windows and Cisco IOS.

How Traceroute Works

• Traceroute is a tool used to trace the path from source to destination.

• It can be used to confirm if traffic is taking the intended path through the network.

• If a destination is unreachable, traceroute can be used to discover how far traffic can travel before it is dropped.

• Traceroute works by sending packets with a TTL of 1, then 2, then 3, etc until reaching the final destination.

• Each router in the path sends ICMP time exceeded messages back to the source.

• Before forwarding a packet, routers decrement its TTL by 1. If this would result in a TTL of 0, the router discards the packet and sends a time exceeded message back to the packet’s source.

Using Traceroute on Linux

• On Linux hosts, use TRACEROUTE followed by hostname or IP address.

• By default, traceroute sends three messages with each TTL value.

• PC1 received three time exceeded messages from R1 when it sent three messages with TTL1.

Using Traceroute on Windows

• In Windows hosts use TRACERT followed by hostname or IP address.

• Unlike other platforms, it sends ICMP Echo Request messages.

Traceroute in Windows

This section covers how to use the TRACERT command in Windows and how it differs from other platforms.

TRACERT Command in Windows

• TRACERT command is used in Windows for tracerouting.

• It uses ICMP echo request messages instead of UDP segments like Cisco IOS and other platforms.

• The command sends three segments per TTL, with each router sending time exceeded messages until the final destination sends an ICMP echo reply message.

Traceroute in Cisco IOS

This section covers how to use the TRACEROUTE command in Cisco IOS and its differences from other platforms.

TRACEROUTE Command in Cisco IOS

• The TRACEROUTE command sends a series of UDP segments with no encapsulated data.

• The destination port of the first segment will be 33434, then 33435, 33436, etc.

• Each router in the path will send time exceeded messages, and the final destination will send destination unreachable messages with code 3 for port unreachable.

• You can add NUMERIC to prevent routers from resolving IP addresses to hostnames.

Output Codes for Traceroute

This section covers output codes that you may receive when using traceroute.

Output Codes for Traceroute

• A chart from Cisco indicates various output codes that you can receive when using traceroute.

• Port Unreachable is listed as an error but does not apply to the final destination which should send Port Unreachable messages.

• Traceroute can give inaccurate results depending on how devices in the path load-balance traffic.

Limitations of Traceroute

This section covers limitations of traceroute.

Limitations of Traceroute

• Depending on how devices in the path load-balance traffic, traceroute could give inaccurate results.

• For example, if a device is load-balancing packets over two paths, traceroute may show that the traffic jumped from one router to another when it actually just took a different path.

Traceroute Overview

This video covers the basics of traceroute, including how it works in Windows and Cisco IOS, and an interesting limitation that might cause traceroute to give inaccurate results.

Per-Packet Load-Sharing

• To demonstrate this issue, R1 is set to do per-packet load-sharing with the IP LOAD-SHARING PER-PACKET command.

• In a real network, you might not have control over how devices in the path load-balance traffic, so you might get unexpected results.

Introduction to Traceroute

• Traceroute is briefly introduced as a tool used to identify the path packets take from one host to another.

• Windows devices use ICMP echo request messages while Cisco IOS and other operating systems use UDP segments.

Quiz Questions

Question 1: Identifying Host Type

• Examine the following output from a packet capture of a Traceroute. What kind of device is the host at 192.168.1.224?

• Answer: B - Windows devices send ICMP echo requests by default for traceroutes.

Question 2: Messages Received by Router

• R1 sends a Traceroute to 8.8.8.8; what kind of messages should it receive in response?

• Answer: A - Destination unreachable and time exceeded messages should be received as shown in the packet capture below all routers in the path should send time exceeded messages, and the final destination host should send destination unreachable messages specifically code 3 port unreachable.

Question 3: Sending Numeric Traceroutes

• Which of the following commands can be used to send a traceroute that does not resolve IP addresses to hostnames?

• Answer: D - TRACEROUTE 8.8.8.8 NUMERIC is used in Cisco IOS to send a traceroute without attempting to resolve IP addresses to hostnames, making the traceroute command finish much faster if you don’t need the hostname information.

Conclusion

• Traceroute is a useful tool for identifying the path packets take from one host to another.

• Windows devices use ICMP echo request messages while Cisco IOS and other operating systems use UDP segments.

• Unexpected results may occur when load-balancing traffic in real networks.

• Numeric traceroutes can be sent using TRACEROUTE 8.8.8.8 NUMERIC in Cisco IOS.

• Thanks for watching!