1TRACEROUTE(8)                Traceroute For Linux                TRACEROUTE(8)
2
3
4

NAME

6       traceroute - print the route packets trace to network host
7

SYNOPSIS

9       traceroute [-46dFITUnreAV] [-f first_ttl] [-g gate,...]
10               [-i device] [-m max_ttl] [-p port] [-s src_addr]
11               [-q nqueries] [-N squeries] [-t tos]
12               [-l flow_label] [-w waittimes] [-z sendwait] [-UL] [-D]
13               [-P proto] [--sport=port] [-M method] [-O mod_options]
14               [--mtu] [--back]
15               host [packet_len]
16       traceroute6  [options]
17

DESCRIPTION

19       traceroute  tracks  the route packets taken from an IP network on their
20       way to a given host. It utilizes the IP protocol's time to  live  (TTL)
21       field  and  attempts to elicit an ICMP TIME_EXCEEDED response from each
22       gateway along the path to the host.
23
24       traceroute6 is equivalent to traceroute -6
25
26       The only required parameter is the name or IP address of  the  destina‐
27       tion host .  The optional packet_len`gth is the total size of the prob‐
28       ing packet (default 60 bytes for IPv4 and 80 for IPv6).  The  specified
29       size  can  be  ignored  in some situations or increased up to a minimal
30       value.
31
32       This program attempts to trace the route an IP packet would  follow  to
33       some internet host by launching probe packets with a small ttl (time to
34       live) then listening for an ICMP "time exceeded" reply from a  gateway.
35       We  start our probes with a ttl of one and increase by one until we get
36       an ICMP "port unreachable" (or TCP reset), which means we  got  to  the
37       "host",  or  hit  a  max  (which defaults to 30 hops). Three probes (by
38       default) are sent at each ttl setting and a line is printed showing the
39       ttl,  address  of  the  gateway  and round trip time of each probe. The
40       address can be followed by additional information  when  requested.  If
41       the  probe  answers  come  from different gateways, the address of each
42       responding system will be printed.  If there is no  response  within  a
43       certain timeout, an "*" (asterisk) is printed for that probe.
44
45       After the trip time, some additional annotation can be printed: !H, !N,
46       or !P  (host,  network  or  protocol  unreachable),  !S  (source  route
47       failed),  !F (fragmentation needed), !X (communication administratively
48       prohibited), !V (host precedence violation), !C (precedence  cutoff  in
49       effect),  or  !<num>  (ICMP unreachable code <num>).  If almost all the
50       probes result in some kind of unreachable, traceroute will give up  and
51       exit.
52
53       We don't want the destination host to process the UDP probe packets, so
54       the destination port is set to an unlikely value  (you  can  change  it
55       with  the  -p flag). There is no such a problem for ICMP or TCP tracer‐
56       outing (for TCP we use half-open technique, which prevents  our  probes
57       to be seen by applications on the destination host).
58
59       In  the  modern  network environment the traditional traceroute methods
60       can not be always applicable, because of widespread use  of  firewalls.
61       Such  firewalls  filter  the "unlikely" UDP ports, or even ICMP echoes.
62       To solve this, some additional  tracerouting  methods  are  implemented
63       (including  tcp), see LIST OF AVAILABLE METHODS below. Such methods try
64       to use particular protocol and source/destination  port,  in  order  to
65       bypass  firewalls  (to  be seen by firewalls just as a start of allowed
66       type of a network session).
67

OPTIONS

69       --help Print help info and exit.
70
71       -4, -6 Explicitly force IPv4 or IPv6 tracerouting. By default, the pro‐
72              gram  will  try to resolve the name given, and choose the appro‐
73              priate protocol automatically. If resolving a host name  returns
74              both IPv4 and IPv6 addresses, traceroute will use IPv4.
75
76       -I, --icmp
77              Use ICMP ECHO for probes
78
79       -T, --tcp
80              Use TCP SYN for probes
81
82       -d, --debug
83              Enable  socket  level  debugging (when the Linux kernel supports
84              it)
85
86       -F, --dont-fragment
87              Do not fragment probe packets. (For IPv4 it also  sets  DF  bit,
88              which  tells  intermediate  routers  not to fragment remotely as
89              well).
90
91              Varying the size of the probing packet by the packet_len command
92              line  parameter,  you  can manually obtain information about the
93              MTU of individual network hops. The  --mtu  option  (see  below)
94              tries to do this automatically.
95
96              Note, that non-fragmented features (like -F or --mtu) work prop‐
97              erly since the Linux kernel 2.6.22 only.  Before  that  version,
98              IPv6  was always fragmented, IPv4 could use the once the discov‐
99              ered final mtu only (from the route cache), which  can  be  less
100              than the actual mtu of a device.
101
102       -f first_ttl, --first=first_ttl
103              Specifies with what TTL to start. Defaults to 1.
104
105       -g gateway, --gateway=gateway
106              Tells  traceroute to add an IP source routing option to the out‐
107              going packet that tells the network to route the packet  through
108              the specified gateway (most routers have disabled source routing
109              for security reasons).  In general, several gateway's is allowed
110              (comma  separated).  For  IPv6, the form of num,addr,addr...  is
111              allowed, where num is a route header type (default is  type  2).
112              Note the type 0 route header is now deprecated (rfc5095).
113
114       -i interface, --interface=interface
115              Specifies  the  interface  through  which traceroute should send
116              packets. By default, the interface is selected according to  the
117              routing table.
118
119       -m max_ttl, --max-hops=max_ttl
120              Specifies  the  maximum  number of hops (max time-to-live value)
121              traceroute will probe. The default is 30.
122
123       -N squeries, --sim-queries=squeries
124              Specifies the number of probe packets sent  out  simultaneously.
125              Sending several probes concurrently can speed up traceroute con‐
126              siderably. The default value is 16.
127              Note that some routers and hosts can use ICMP  rate  throttling.
128              In such a situation specifying too large number can lead to loss
129              of some responses.
130
131       -n     Do not try to map IP addresses to  host  names  when  displaying
132              them.
133
134       -p port, --port=port
135              For  UDP tracing, specifies the destination port base traceroute
136              will use (the destination port number  will  be  incremented  by
137              each probe).
138              For  ICMP  tracing,  specifies  the  initial ICMP sequence value
139              (incremented by each probe too).
140              For TCP and others specifies  just  the  (constant)  destination
141              port to connect.
142
143       -t tos, --tos=tos
144              For  IPv4,  set  the Type of Service (TOS) and Precedence value.
145              Useful values are 16 (low delay) and 8 (high  throughput).  Note
146              that  in order to use some TOS precedence values, you have to be
147              super user.
148              For IPv6, set the Traffic Control value.
149
150       -l flow_label, --flowlabel=flow_label
151              Use specified flow_label for IPv6 packets.
152
153       -w max[,here,near], --wait=max[,here,near]
154              Determines how long to wait for a response to a probe.
155
156              There are three (in general) float values separated by  a  comma
157              (or  a  slash).   Max  specifies  the  maximum time (in seconds,
158              default 5.0) to wait, in any case.
159
160              Traditional traceroute implementation always  waited  whole  max
161              seconds  for any probe. But if we already have some replies from
162              the same hop, or even from some next hop, we can use  the  round
163              trip time of such a reply as a hint to determine the actual rea‐
164              sonable amount of time to wait.
165
166              The optional here (default 3.0) specifies a factor  to  multiply
167              the  round  trip  time  of an already received response from the
168              same hop. The resulting value is  used  as  a  timeout  for  the
169              probe,  instead  of  (but  no more than) max.  The optional near
170              (default 10.0) specifies a similar factor for  a  response  from
171              some  next  hop.  (The time of the first found result is used in
172              both cases).
173
174              First, we look for the same hop (of  the  probe  which  will  be
175              printed  first  from now).  If nothing found, then look for some
176              next hop. If nothing found, use max.  If here and/or  near  have
177              zero values, the corresponding computation is skipped.
178              Here  and  near  are always set to zero if only max is specified
179              (for compatibility with previous versions).
180
181       -q nqueries, --queries=nqueries
182              Sets the number of probe packets per hop. The default is 3.
183
184       -r     Bypass the normal routing tables and send directly to a host  on
185              an  attached network.  If the host is not on a directly-attached
186              network, an error is returned.  This option can be used to  ping
187              a local host through an interface that has no route through it.
188
189       -s source_addr, --source=source_addr
190              Chooses an alternative source address. Note that you must select
191              the address of one of the interfaces.  By default,  the  address
192              of the outgoing interface is used.
193
194       -z sendwait, --sendwait=sendwait
195              Minimal  time interval between probes (default 0).  If the value
196              is more than 10, then it specifies  a  number  in  milliseconds,
197              else it is a number of seconds (float point values allowed too).
198              Useful when some routers use rate-limit for ICMP messages.
199
200       -e, --extensions
201              Show ICMP extensions (rfc4884). The general form is  CLASS/TYPE:
202              followed  by  a  hexadecimal  dump.  The MPLS (rfc4950) is shown
203              parsed, in a  form:  MPLS:L=label,E=exp_use,S=stack_bottom,T=TTL
204              (more objects separated by / ).
205
206       -A, --as-path-lookups
207              Perform  AS path lookups in routing registries and print results
208              directly after the corresponding addresses.
209
210       -V, --version
211              Print the version and exit.
212
213       There are additional options  intended  for  advanced  usage  (such  as
214       alternate trace methods etc.):
215
216       --sport=port
217              Chooses  the  source  port to use. Implies -N 1 -w 5 .  Normally
218              source ports (if applicable) are chosen by the system.
219
220       --fwmark=mark
221              Set the firewall mark for outgoing packets (since the Linux ker‐
222              nel 2.6.25).
223
224       -M method, --module=name
225              Use  specified  method for traceroute operations. Default tradi‐
226              tional udp method has name default, icmp (-I) and tcp (-T)  have
227              names icmp and tcp respectively.
228              Method-specific options can be passed by -O .  Most methods have
229              their simple shortcuts, (-I means -M icmp, etc).
230
231       -O option, --options=options
232              Specifies some method-specific option. Several options are sepa‐
233              rated  by comma (or use several -O on cmdline).  Each method may
234              have its own specific options, or many not have them at all.  To
235              print information about available options, use -O help.
236
237       -U, --udp
238              Use UDP to particular destination port for tracerouting (instead
239              of increasing the port per  each  probe).  Default  port  is  53
240              (dns).
241
242       -UL    Use UDPLITE for tracerouting (default port is 53).
243
244       -D, --dccp
245              Use DCCP Requests for probes.
246
247       -P protocol, --protocol=protocol
248              Use  raw  packet of specified protocol for tracerouting. Default
249              protocol is 253 (rfc3692).
250
251       --mtu  Discover MTU along the path being traced. Implies -F -N 1.   New
252              mtu  is  printed once in a form of F=NUM at the first probe of a
253              hop which requires such mtu to be reached. (Actually, the corre‐
254              spond  "frag needed" icmp message normally is sent by the previ‐
255              ous hop).
256
257              Note, that some routers might cache once the seen information on
258              a  fragmentation.  Thus  you  can  receive  the final mtu from a
259              closer hop.  Try to specify an unusual tos by -t , this can help
260              for one attempt (then it can be cached there as well).
261              See -F option for more info.
262
263       --back Print  the  number of backward hops when it seems different with
264              the forward direction. This number is guessed in assumption that
265              remote  hops  send  reply packets with initial ttl set to either
266              64, or 128 or 255 (which seems a common practice). It is printed
267              as a negate value in a form of '-NUM' .
268

LIST OF AVAILABLE METHODS

270       In  general,  a  particular  traceroute method may have to be chosen by
271       -M name, but most of the methods have  their  simple  cmdline  switches
272       (you can see them after the method name, if present).
273
274   default
275       The traditional, ancient method of tracerouting. Used by default.
276
277       Probe  packets  are udp datagrams with so-called "unlikely" destination
278       ports.  The "unlikely" port of the first probe is 33434, then for  each
279       next probe it is incremented by one. Since the ports are expected to be
280       unused, the destination host normally returns "icmp unreach port" as  a
281       final  response.  (Nobody knows what happens when some application lis‐
282       tens for such ports, though).
283
284       This method is allowed for unprivileged users.
285
286   icmp       -I
287       Most usual method for now, which uses icmp echo packets for probes.
288       If you can ping(8) the destination host, icmp tracerouting is  applica‐
289       ble as well.
290
291       This  method may be allowed for unprivileged users since the kernel 3.0
292       (IPv4, for IPv6 since 3.11), which supports new dgram icmp (or  "ping")
293       sockets.    To    allow   such   sockets,   sysadmin   should   provide
294       net/ipv4/ping_group_range sysctl range to match any group of the user.
295       Options:
296
297       raw    Use only raw sockets (the traditional way).
298              This way is tried first by default (for compatibility  reasons),
299              then new dgram icmp sockets as fallback.
300
301       dgram  Use only dgram icmp sockets.
302
303   tcp        -T
304       Well-known modern method, intended to bypass firewalls.
305       Uses the constant destination port (default is 80, http).
306
307       If some filters are present in the network path, then most probably any
308       "unlikely" udp ports (as for default method) or even  icmp  echoes  (as
309       for icmp) are filtered, and whole tracerouting will just stop at such a
310       firewall.  To bypass a network filter, we have to use only allowed pro‐
311       tocol/port  combinations.  If  we trace for some, say, mailserver, then
312       more likely -T -p 25 can reach it, even when -I can not.
313
314       This method  uses  well-known  "half-open  technique",  which  prevents
315       applications  on  the  destination  host from seeing our probes at all.
316       Normally, a tcp syn is sent. For  non-listened  ports  we  receive  tcp
317       reset,  and  all  is  done.  For  active listening ports we receive tcp
318       syn+ack, but answer by tcp reset (instead of expected  tcp  ack),  this
319       way the remote tcp session is dropped even without the application ever
320       taking notice.
321
322       There is a couple of options for tcp method:
323
324       syn,ack,fin,rst,psh,urg,ece,cwr
325              Sets specified tcp flags for probe packet, in any combination.
326
327       flags=num
328              Sets the flags field in the tcp header exactly to num.
329
330       ecn    Send syn packet with tcp flags ECE and CWR (for Explicit Conges‐
331              tion Notification, rfc3168).
332
333       sack,timestamps,window_scaling
334              Use  the  corresponding  tcp header option in the outgoing probe
335              packet.
336
337       sysctl Use current sysctl (/proc/sys/net/*) setting for the tcp  header
338              options  above  and ecn.  Always set by default, if nothing else
339              specified.
340
341       mss=num
342              Use value of num for maxseg tcp header option (when syn).
343
344       info   Print tcp flags of final tcp replies when  the  target  host  is
345              reached.  Allows to determine whether an application listens the
346              port and other useful things.
347
348       Default options is syn,sysctl.
349
350   tcpconn
351       An initial implementation of tcp method, simple using connect(2)  call,
352       which  does  full  tcp session opening. Not recommended for normal use,
353       because a destination application is always affected (and can  be  con‐
354       fused).
355
356   udp        -U
357       Use udp datagram with constant destination port (default 53, dns).
358       Intended to bypass firewall as well.
359
360       Note, that unlike in tcp method, the correspond application on the des‐
361       tination host always receive our probes (with random  data),  and  most
362       can  easily  be confused by them. Most cases it will not respond to our
363       packets though, so we will never see the final hop in the trace.  (For‐
364       tunately,  it  seems  that  at least dns servers replies with something
365       angry).
366
367       This method is allowed for unprivileged users.
368
369   udplite    -UL
370       Use udplite  datagram  for  probes  (with  constant  destination  port,
371       default 53).
372
373       This method is allowed for unprivileged users.
374       Options:
375
376       coverage=num
377              Set udplite send coverage to num.
378
379   dccp    -D
380       Use DCCP Request packets for probes (rfc4340).
381
382       This  method  uses the same "half-open technique" as used for TCP.  The
383       default destination port is 33434.
384
385       Options:
386
387       service=num
388              Set DCCP service code to num (default is 1885957735).
389
390   raw        -P proto
391       Send raw packet of protocol proto.
392       No protocol-specific headers are used, just IP header only.
393       Implies -N 1 -w 5 .
394       Options:
395
396       protocol=proto
397              Use IP protocol proto (default 253).
398

NOTES

400       To speed up work, normally several probes are sent simultaneously.   On
401       the  other  hand,  it  creates a "storm of packages", especially in the
402       reply direction. Routers can throttle the rate of icmp  responses,  and
403       some  of  replies  can  be  lost. To avoid this, decrease the number of
404       simultaneous probes, or even set it to 1 (like  in  initial  traceroute
405       implementation), i.e.  -N 1
406
407       The  final  (target) host can drop some of the simultaneous probes, and
408       might even answer only the latest ones. It can  lead  to  extra  "looks
409       like  expired"  hops  near  the  final hop. We use a smart algorithm to
410       auto-detect such a situation, but if it cannot help in your case,  just
411       use -N 1 too.
412
413       For  even  greater stability you can slow down the program's work by -z
414       option, for example use -z 0.5 for half-second pause between probes.
415
416       To avoid an extra waiting, we use adaptive algorithm for timeouts  (see
417       -w  option  for more info). It can lead to premature expiry (especially
418       when response times differ at times) and  printing  "*"  instead  of  a
419       time.  In such a case, switch this algorithm off, by specifying -w with
420       the desired timeout only (for example, -w 5).
421
422       If some hops report nothing for every method, the last chance to obtain
423       something  is  to  use  ping  -R  command (IPv4, and for nearest 8 hops
424       only).
425

SEE ALSO

427       ping(8), ping6(8), tcpdump(8), netstat(8)
428
429
430
431Traceroute                      11 October 2006                  TRACEROUTE(8)
Impressum