What Does a Traceroute Do?
As its name suggests, traceroute traces the route that a packet takes while traveling from its source to its destination. The traceroute protocol sends out a series of packets designed to identify each router hop along a packet’s path.
Traceroute can be used to map paths over a network and also to diagnose certain types of network issues. For example, a user’s computer may not be able to reach another system. Using traceroute, it’s possible to identify the successful hops that the packet makes along that path and the point at which the connection fails. This information can be used to identify an offline router or other issue that is causing the connection to fail.
How Does Traceroute Work?
Traceroute takes advantage of one of the fields within an Internet Protocol (IP) packet header called the time to live (TTL). This field specifies the maximum number of hops that a packet can take en route to its destination and was initially developed to protect against routing loops where a packet might cycle through a network forever.
If a network packet’s TTL value is reached, the router at which it fails will send a TTL-exceeded message back to the sender. This could be used to diagnose the issue but is also key to how traceroute works.
A traceroute will send a series of packets, starting with a TTL of 1 and incrementing with each round of three packets. The first set of packets will fail at the first router on its path, causing the router to send an error message back to the sender. Since this error packet will include the IP address of the router sending it, the sender can identify the first router on its path.
Each subsequent set of packets will make it one hop further than the previous. At each stage, the final router will send back an error message, allowing the sender to record the IP address and build up a map of the route.
This process will end either when the destination is reached or the maximum hop count — which defaults to 30 but is user-configurable — is reached. At this point, the sender will have a complete map of the route that the packets took on their way to the specified destination.
How to Run a Traceroute
Traceroute is built into most operating systems by default. In Windows, the command is tracert, while the traceroute command is used on Linux and Mac systems.
Traceroute is a command-line utility and can be used with domain names or IP addresses. Typing tracert <target> on Windows or traceroute <target> on Mac or Linux will run the utility and cause the results to be printed in the terminal. For example, performing a traceroute to the Check Point Website on Windows can be accomplished by typing tracert checkpoint.com in the Windows Command Prompt.
How to Read Traceroute Results
Traceroute’s results will begin with a header line describing the operation performed, such as a traceroute to checkpoint.com with 30 hops. After that, each line of the output will describe one hop along the route.
Each of these hop outputs will include a set of timestamps, which describe the time taken by each packet in the set to reach the destination. This can be helpful for diagnosing latency issues in network traffic.
Each result will also list the IP address(es) and/or domain name(s) of each hop along the route. Since each round of traceroute contains three packets, different packets may take different routes. Traceroute will record all of the routes that it used for each hop.
These IP addresses and hostnames can be used to trace a packet’s route to its destination. For example, a Whois database can provide insight into the company that owns a particular IP address or domain name and therefore owns the router that the packet passed through at that hop.
Check Point Solutions and Traceroute
Traceroute is a valuable tool for diagnosing various networking issues. It can identify where a connection is failing during its travel through a network or which router is causing significant latency in a connection.
Check Point has deep expertise in network security with over 30 years of experience in developing firewalls and a comprehensive network security portfolio covering cloud, endpoints, mobile, and IoT security.
Check Point solutions are designed to provide all of the tools and capabilities needed to protect an organization’s networks and systems against attack. For example, Check Point’s Gaia OS includes traceroute along with other standard network tool sets to support network diagnostics and security efforts.
Feedback