Traceroute

traceroute tells about the path between the two addresses. Say, if we need to trace the path from host A to host B. traceroute fires off packets that are passed through a series of routers/gateways. Normal network trasactions, like a request for a web page, does not report the path they take from host A to host B. traceroute, on the other hand, triggers a response from every router along the way. It does this by utilizing the IP protocol time to live(TTL) field and attempts to elicit an ICMP TIME_EXCEEDED response from each machine. If successful, it captures the IP address of the machine and the time at which the response  was received.

How traceroute works in  UNIX?


Host A sends 3 UDP packets to host B. These packets are sent to port 33434 in host B. However, the packets returned in response are ICMP packets. If the ICMP response is of type

1.  ICMP Time Exceeded message ( ICMP Type '11' ) response - This means the host responding is not the destination.
2. An ICMP Destination Unreachable - This means the host responding doesn't know how to get to the destination IP address in the traceroute packets.
3. Host A sends three UDP packets with TTL value of 1 to host B. 
4.  The computer/router on which the messages die because the time to live expired (somewhere between host A and host B ) sends back ICMP Time Exceeded (ICMP Type '11') responses. These messages indicate to host A that the traceroute messages have not yet reached the destination host B.
5. Host A receives those Time Exceeded messages, notes the time they arrived, compares that to the time the UDP packet was sent and shows the results of that round trip on the screen.
6. Host A increments the TTL in the IP Header by one, then repeats the previous steps (creates 3 UDP packets, sets the Time to Live to the next highest number, starts a timer, transmits the packets, waits for a response). This process is repeated until the packets reach the destination computer (host B) which host A is tracing the route to.
7. When the destination computer (clown) receives the packets, it sends back an ICMP Reply (ICMP type '0') and the traceroute program stops.