Card 09/ 10
Practice: Reading a traceroute
Eight hops, one row of asterisks and a jump in latency; say what each one means.
Reading traceroute output is the quickest way to see where along a path packets slow down or stop. A user in London reports that a site hosted in the United States is slow. They run traceroute to it and send you the output. The output is illustrative, with documentation addresses.
traceroute 203.0.113.10
traceroute to 203.0.113.10 (203.0.113.10), 30 hops max, 60 byte packets
1 192.168.1.1 1.2 ms 1.1 ms 1.0 ms
2 198.51.100.1 8.4 ms 8.1 ms 8.6 ms
3 198.51.100.9 9.0 ms 8.8 ms 9.2 ms
4 * * *
5 192.0.2.33 11.5 ms 11.2 ms 11.8 ms
6 192.0.2.70 82.4 ms 81.9 ms 83.1 ms
7 203.0.113.1 83.3 ms 83.0 ms 83.6 ms
8 203.0.113.10 83.8 ms 83.5 ms 84.0 msAnswer four questions:
- What is hop 1?
- Is hop 4 a fault?
- What does the jump between hop 5 and hop 6 most likely show?
- The site still fails to load in the browser. What does this output prove, and what does it not?
Show the answers
- Hop 1 is the user's home router, their default gateway: a private address, about a millisecond away.
- Hop 4 is not a fault. That router did not send time-exceeded replies, but hops 5 to 8 answered, so packets passed through it. Asterisks only matter when they continue to the end.
- The jump of about 70 ms is distance. It appears at hop 6 and stays at every later hop, which is what a long link, here likely an ocean crossing, looks like. A congested router would show a jump that later hops do not keep, or times that vary widely.
- It proves the server is reachable at the network layer, since hop 8 is the destination itself and it answered. It does not prove that the web server program is running or that port 443 is open. The next test is a request to the service, such as
curl -v https://203.0.113.10/.
← → move through sections and cards