tracert 3

[lamsf]

Hi,
When I run tracert, I got the following:

~~~~~~~~~~~~~~~~~~~~~~~~~~
C:\Documents and Settings\user>tracert 172.16.10.22
Tracing route to 172.16.10.22 over a maximum of 30 hops 1 1 ms <1 ms <1 ms mygateway1.XXX [192.168.15.1]
2 * * * Request timed out.
3 58 ms 74 ms 74 ms 68.75.152.129
4 54 ms 79 ms 77 ms 172.16.10.22
Trace complete.

C:\Documents and Settings\user>tracert 172.16.10.23
Tracing route to 172.16.10.23 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms mygateway1.XXX [192.168.15.1]
2 * * * Request timed out.
3 62 ms 82 ms 72 ms 68.75.152.129
4 62 ms 74 ms 74 ms 172.16.10.23
Trace complete.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Why do we get the line 2, Request timed out?

Any other info you need to help me find out why we get "Request timed out"?

Thanks a lot...

 

[Serbtastic]

You are not getting a response (Request timed out) from the second hop because it has been configured to not respond to ICMP echo requests. This is not abnormal on the internet.

 

[lamsf]

Thanks a lot Serbtastic.
Since we get "Request timed out", will this affect the total ping time? If it does, how much is the effect?

Thx.

 

[gdvissch]

It will not affect the ping round trip time ...

In fact, how does a traceroute work?

Imagine you want to tracert a host 5 hops away. The tracert will ping the host 5 hops away. This means it will send an ICMP packet of the type "echo request" to the host. Normally the host responds with an "echo reply".
Tracert however changes it a bit. The first "echo request" it sends will have the TTL (time to live) of 1. As you might know, when a router receives an ip packet it will decrement the TTL field by 1 and if the result is 0, it will not forward the packet (this is to counter routing loops).
If we go back to the example, the router will need to drop the first echo request as 1-1=0. Fortunately the ICMP protocol is there to help us again. When a router finds a TTL of 0 it sends back an ICMP packet of the type "TTL exceeded" to the originator. So instead of getting an ICMP "echo reply" from the destination (which is not reached) we get an ICMP "TTL is exceeded" from the first router. This is exactly what we want because we are trying to figure out what route a packet is following so the first router is the first part of the answer.
Once tracert has received the first TTL exceeded, it sends a new "echo request" to the final destination but with a TTL of 2. This time, the second router will answer that it had to drop the packet because of a TTL exceeded and so on. Normally this would give to complete route to the destination.
What can go wrong?
The intermediate routers are configured not to send "TTL exceeded" messages. But they still drop the packet! In this case your tracert is waiting for the TTL exceeded but after a while times out because it does not receive it. (So not the echo reply, but the TTL exceeded). Tracert deduces the router does not send ICMP packets and therefore adds a line of * * *
If the next router does respond you would get some figures again after the line of "* * *"
Another possibility is that somewhere in between, there is a firewall blocking ICMP ttl exceeded messages (or some combination of echo request, echo reply etc…). When this happens starting form a certain hop count you only see stars, until you get to the destination…

If you ping the destination (without using tracert, so a TTL of 128 on my XP machine) the only one responding will be the destination, provided it lives closer then 128 hops away and routers configured not to send TTL exceeded messages have no impact on the Round trip time…

I hope this helps
G.

 

[LawnBoy]

Excellent description, gdvissch.

 

[gdvissch]

Thanks LawnBoy