Traceroute Isn't Real | Gekk

I don't use traceroute often but I have used it plenty over the years to see what network path things are taking. I assumed it was some network capability to identify this. It turns out it is completely a hack!

When you send a packet to a destination, it often has to go through multiple routers, or "hops."

To prevent packets from cycling indefinitely in a network due to routing loops (router A points to router B which points to router A...) they include a Time-To-Live field, which is set to a reasonably high value when a packet is created, and each machine that the packet passes through decrements that field by one.

When the field hits zero, the packet gets thrown away. As a courtesy, the router that's dropping the packet has the option to generate a new packet, using the ICMP protocol, with the subtype "TTL Exceeded," and send it back to the originating machine, to let it know there's something wrong with the network path.

These clever fellows in 1987 realized that by manipulating the TTL value, you can choose which router will send that ICMP message.

Send a packet with the TTL set to 1. The first router you hit will decrement it to zero. The packet is now "dead", so it drops the packet, and sends back TTL Exceeded. That response will originate from the router's own IP address - congratulations, you now have the IP of the first hop.

Now send another with the TTL set to 2. The first router will decrement it to 1 and pass it, and the second one will decrement to zero and drop it. Now you have its IP address.

Repeat, increasing TTL each time, until the final hop responds. You now have your complete path.

So, a couple things…

1. I say this is a hack as a form of praise. Delightful way to "solve" the problem.
2. The way this works is not super resilient so could give you really misleading responses.

I’m gonna chuckle every time I use traceroute from now on. 😊