Traceroute
a utility that lets you discover the path between 2 nodes, and gives you information about each hop along the way
- The way traceroute works is through a clever manipulation technique of the TTL field at the IP level
- Traceroute uses the TTL field by first setting it to 1 for the first packet, then 2 for the second, 3 for the third, and so on.
- By doing this clever little action, traceroute makes sure that the very first packet sent will be discarded by the first router hop. This results in an ICMP time exceeded message. The second packet will make it to the second router, the third will make it to the third, and so on. This continues until the packet finally makes it all the way to its destination.
- For each hop, traceroute will send three identical packets. Just like with Ping, the output of a Traceroute command is pretty simple.
Two more tools that are similar to traceroute are mtr on Linux and macOS, and pathping on Windows. These two tools act as long running trace routes so you can better see how things change over a period of time.
- mtr works in real-time and will continually update its output with all the current aggregate data about the traceroute. You can compare this with pathping, which runs for 50 seconds and then displays the final aggregate data all at once.