Quick traceroute question

Hi,

when you have a traceroute saying something like:

1 192.168.100.3 104 msec
192.168.12.1 244 msec
192.168.100.3 88 msec
2 192.168.100.113 104 msec
192.168.12.111 244 msec
192.168.100.113 88 msec

(dont give the IP's any meaning, its just for an example).

How should one read each individual line (cisco's "understanding ping and traceroute" doesnt cover this afaik).

Will it goto only one of them (next hop)? Clearly there are multiple ways, but im curious as to how to understand that output.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

dtlokee

By default a Cisco router will load balance on up to 4 equal cost paths. If there are multiple paths to a destination in the routing table it will send packets to all of them.

kpjungle

dtlokee wrote:

By default a Cisco router will load balance on up to 4 equal cost paths. If there are multiple paths to a destination in the routing table it will send packets to all of them.

Thats interesting. So a traceroute will send a packet to each of the destinations. I thought it would use process-switching, and choose a next-hop one by one. So its not using either process or fast switching, but just flooding to all next-hops for that destination?

Scenario:

R1 is connected by a lan segment to R2 and R3. This lan segment is 192.168.100.0/24. R2 and R3 are connected with a serial link (172.16.1.0/24).

From R1, i see:
R1#traceroute 172.16.1.1

Type escape sequence to abort.
Tracing the route to 172.16.1.1

1 192.168.100.4 104 msec
192.168.100.3 168 msec
192.168.100.4 12 msec

Howcome theres the 3 "paths"?

dtlokee

Traceroute will send out 3 packets one at a time and wait for the response. On a Cisco router they use UDP packets sent to the destination port range of 33434 - 33464

kpjungle

dtlokee wrote:

Traceroute will send out 3 packets one at a time and wait for the response. On a Cisco router they use UDP packets sent to the destination port range of 33434 - 33464

Thanks for your time and help. In my example, does that mean it sends 1 packet to 192.168.100.4 first, then one to 192.168.100.3, and finally another one to 192.168.100.4 ?

GT-Rob

Yes.

Its the same as when you ping and there is only 1 path, you get 3 reponses. Because there is more than 1 path (2 or more), it seperates them (each response) into each line.

kpjungle

GT-Rob wrote:

Yes.

Its the same as when you ping and there is only 1 path, you get 3 reponses. Because there is more than 1 path (2 or more), it seperates them (each response) into each line.

Okay.. not sure im 100% following it, but is there any documentation/books i can catch up on it?

dtlokee

Look up multiple path load balancing on a Cisco router.

kpjungle

dtlokee wrote:

Look up multiple path load balancing on a Cisco router.

Thanks,

Ive found these two "relevant" links, im not sure if there are some more relevant ones.

Load Balancing in general:
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094820.shtml

Info on traceroute and ping:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml

A follow-up question, if you guys dont mind:

Scenario

R1 connected to both R2 and R3 with serial links. R2 and R3 are connected to R4 through a lan segment. If i traceroute from R1 to a loopback on R4, it, as you all said, sends out three packets:

1 172.16.13.3
172.16.12.2
172.16.13.3

This first step, I can understand. It has dual paths, send one packet to the first, another to the second, and the third to the first one again. By debugging and playing around with it, i have never managed to get 3 "replies" in step two, Shouldnt the two different routers (R2 and R3) further propagate the next 3 packets (TTL=2), so i would get 3 replies in step two as well? Thats where i think im missing out.