1.\" $OpenBSD: traceroute.8,v 1.63 2015/09/14 20:06:59 schwarze Exp $ 2.\" $NetBSD: traceroute.8,v 1.6 1995/10/12 03:05:50 mycroft Exp $ 3.\" 4.\" Copyright (c) 1990, 1991, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" This code is derived from software contributed to Berkeley by 8.\" Van Jacobson. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" @(#)traceroute.8 8.1 (Berkeley) 6/6/93 35.\" 36.Dd $Mdocdate: September 14 2015 $ 37.Dt TRACEROUTE 8 38.Os 39.Sh NAME 40.Nm traceroute , 41.Nm traceroute6 42.Nd print the route packets take to network host 43.Sh SYNOPSIS 44.Nm traceroute\ \& 45.Op Fl AcDdIlnSvx 46.Op Fl f Ar first_ttl 47.Op Fl g Ar gateway_addr 48.Op Fl m Ar max_ttl 49.Op Fl P Ar proto 50.Op Fl p Ar port 51.Op Fl q Ar nqueries 52.Op Fl s Ar src_addr 53.Op Fl t Ar toskeyword 54.Op Fl V Ar rtable 55.Op Fl w Ar waittime 56.Ar host 57.Op Ar datalen 58.Nm traceroute6 59.Op Fl AcDdIlnSv 60.Op Fl f Ar first_hop 61.Op Fl m Ar max_hop 62.Op Fl p Ar port 63.Op Fl q Ar nqueries 64.Op Fl s Ar src_addr 65.Op Fl V Ar rtable 66.Op Fl w Ar waittime 67.Ar host 68.Op Ar datalen 69.Sh DESCRIPTION 70The Internet is a large and complex aggregation of 71network hardware, connected together by gateways. 72Tracking the route packets follow (or finding the miscreant 73gateway that's discarding packets) can be difficult. 74.Nm 75utilizes the IPv4 protocol time to live (TTL) field 76and attempts to elicit an ICMP 77.Dv TIME_EXCEEDED 78response from each gateway along the path to some 79host. 80.Nm traceroute6 81does the same for the IPv6 protocol, 82instead using hop limits and ICMPv6 83.Dv TIME_EXCEEDED 84responses. 85.Pp 86The only mandatory parameter is the destination host name or IP number. 87The default probe datagram length is 40 bytes for IPv4 UDP and 60 88bytes for ICMP, IPv6 UDP and ICMP6. 89This may be increased by 90.Ar datalen 91bytes. 92.Pp 93The options are as follows: 94.Bl -tag -width Ds 95.It Fl A 96Look up the AS number for each hop address. 97Uses the DNS service described at 98.Lk http://www.team-cymru.org/Services/ip-to-asn.html . 99.It Fl c 100Do not increment the destination port number in successive UDP packets. 101Rather, all UDP packets will have the same destination port, as set via the 102.Fl p 103flag (or 33434 if none is specified). 104.It Fl D 105Dump the packet data to standard error before transmitting it. 106.It Fl d 107Turn on socket-level debugging. 108.It Fl f Ar first_ttl 109Set the first TTL or hop limit used in outgoing probe packets. 110The effect is that the first first_ttl \- 1 hosts will be skipped 111in the output of 112.Nm traceroute . 113The default value is 1 (skip no hosts). 114.It Fl g Ar gateway_addr 115Add 116.Ar gateway_addr 117to the list of addresses in the IP Loose Source Record Route (LSRR) 118option. 119If no gateways are specified, the LSRR option is omitted. 120This option is not available for IPv6. 121.It Fl I 122Use ICMP or ICMP6 ECHO instead of UDP datagrams. 123.It Fl l 124Display the TTL or hop limit value of the returned packet. 125This is useful for checking for asymmetric routing. 126.It Fl m Ar max_ttl 127Set the maximum TTL or hop limit. 128The default is the value of the system's 129.Cm net.inet.ip.ttl 130or 131.Cm net.inet6.ip6.hlim 132MIB variable, which defaults to 64. 133.It Fl n 134Print hop addresses numerically rather than symbolically and numerically 135(saves a nameserver address-to-name lookup for each gateway found on the 136path). 137.It Fl P Ar proto 138Change the protocol being used from UDP 139to a numeric protocol or a name as specified in 140.Pa /etc/protocols . 141This will not work reliably for most protocols. 142If set to 1 (ICMP), then 143ICMP Echo Request messages will be used (same as 144.Xr ping 8 ) . 145This option is not available for IPv6. 146.It Fl p Ar port 147Set the base UDP 148.Ar port 149number used in probes (default is 33434). 150.Nm 151hopes that nothing is listening on UDP ports 152.Em base 153to 154.Em base+nhops*nqueries-1 155at the destination host (so an ICMP 156.Dv PORT_UNREACHABLE 157message will 158be returned to terminate the route tracing). 159If something is 160listening on a port in the default range, this option can be used 161to pick an unused port range. 162.It Fl q Ar nqueries 163Set the number of probes per TTL to 164.Ar nqueries 165(default is three probes). 166.It Fl S 167Print how many probes were not answered for each hop. 168.It Fl s Ar src_addr 169Use the following IP address 170(which must be given as an IP number, not 171a hostname) as the source address in outgoing probe packets. 172On hosts with more than one IP address, this option can be used to 173force the source address to be something other than the IP address 174of the interface the probe packet is sent on. 175If the IP address 176is not one of this machine's interface addresses and the user is 177not the superuser, an error is returned and nothing is sent. 178.It Fl t Ar toskeyword 179Set the 180.Em type-of-service 181in probe packets to the following value (default zero). 182The value may be one of 183.Ar critical , 184.Ar inetcontrol , 185.Ar lowdelay , 186.Ar netcontrol , 187.Ar throughput , 188.Ar reliability , 189or one of the DiffServ Code Points: 190.Ar ef , 191.Ar af11 ... af43 , 192.Ar cs0 ... cs7 ; 193or a number in either hex or decimal. 194This option can be used to 195see if different types-of-service result in different paths. 196If this option is used, changes to the type-of-service in the 197returned packets are displayed. 198(If you are not running a 199.Bx 4.3 tahoe 200or later system, this may be academic since the normal network 201services like telnet and ftp don't let you control the 202.Dv TOS ) . 203Not all values of 204.Dv TOS 205are legal or 206meaningful \- see the IP spec for definitions. 207Useful values are probably 208.Ar lowdelay 209and 210.Ar throughput . 211This option is not available for IPv6. 212.It Fl V Ar rtable 213Set the routing table to be used. 214.It Fl v 215Verbose output. 216Received ICMP packets other than 217.Dv TIME_EXCEEDED 218and 219.Dv UNREACHABLE Ns s 220are listed. 221.It Fl w Ar waittime 222Set the time (in seconds) to wait for a response to a probe (default 5). 223.It Fl x 224Print the ICMP extended headers if available. 225This option is not available for IPv6. 226.El 227.Pp 228This program attempts to trace the route an IP packet would follow to some 229internet host by launching UDP probe packets with a small TTL 230then listening for an ICMP "time exceeded" reply from a gateway. 231We start out probes with a TTL of one and increase by one until we get an 232ICMP "port unreachable" 233(which means we got to "host") or hit a max (which 234defaults to 64 hops and can be changed with the 235.Fl m 236flag). 237Three probes (changed with 238.Fl q 239flag) are sent at each TTL setting and a 240line is printed showing the TTL, address of the gateway and 241round trip time of each probe. 242If the probe answers come from 243different gateways, the address of each responding system will 244be printed. 245If there is no response within a 5 second timeout 246interval (changed with the 247.Fl w 248flag), a "*" is printed for that 249probe. 250.Pp 251We don't want the destination 252host to process the UDP 253probe packets so the destination port is set to an 254unlikely value (if some clod on the destination is using that 255value, it can be changed with the 256.Fl p 257flag). 258.Pp 259A sample use and output might be: 260.Bd -literal -offset indent 261$ traceroute nis.nsf.net. 262traceroute to nis.nsf.net (35.1.1.48), 64 hops max, 56 byte packet 2631 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms 2642 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2653 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2664 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms 2675 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms 2686 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms 2697 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms 2708 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms 2719 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms 27210 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms 27311 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms 274.Ed 275.Pp 276Note that lines 2 & 3 are the same. 277This is due to a buggy 278kernel on the 2nd hop system \- lbl-csam.arpa \- that forwards 279packets with a zero TTL (a bug in the distributed version of 280.Bx 4.3 ) . 281Note that you have to guess what path 282the packets are taking cross-country since the NSFNET (129.140) 283doesn't supply address-to-name translations for its NSSes. 284.Pp 285A more interesting example is: 286.Bd -literal -offset indent 287$ traceroute allspice.lcs.mit.edu. 288traceroute to allspice.lcs.mit.edu (18.26.0.115), 64 hops max 2891 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 2902 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms 2913 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms 2924 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms 2935 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms 2946 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms 2957 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms 2968 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms 2979 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms 29810 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms 29911 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms 30012 * * * 30113 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms 30214 * * * 30315 * * * 30416 * * * 30517 * * * 30618 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms 307.Ed 308.Pp 309Note that the gateways 12, 14, 15, 16 & 17 hops away 310either don't send ICMP "time exceeded" messages or send them 311with a TTL too small to reach us. 31214 \- 17 are running the MIT 313C Gateway code that doesn't send "time exceeded"s. 314God only knows what's going on with 12. 315.Pp 316The silent gateway 12 in the above may be the result of a bug in 317the 4.[23] 318.Bx 319network code (and its derivatives): 4.x (x <= 3) 320sends an unreachable message using whatever TTL remains in the 321original datagram. 322Since, for gateways, the remaining TTL is zero, the ICMP 323"time exceeded" is guaranteed to not make it back to us. 324The behavior of this bug is slightly more interesting 325when it appears on the destination system: 326.Bd -literal -offset indent 3271 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 3282 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms 3293 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms 3304 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms 3315 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms 3326 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms 3337 * * * 3348 * * * 3359 * * * 33610 * * * 33711 * * * 33812 * * * 33913 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms ! 340.Ed 341.Pp 342Notice that there are 12 "gateways" (13 is the final 343destination) and exactly the last half of them are "missing". 344What's really happening is that rip (a Sun-3 running Sun OS3.5) 345is using the TTL from our arriving datagram as the TTL in its 346ICMP reply. 347So, the reply will time out on the return path 348(with no notice sent to anyone since ICMPs aren't sent for ICMPs) 349until we probe with a TTL that's at least twice the path 350length. 351That is, rip is really only 7 hops away. 352A reply that returns with a TTL of 1 is a clue this problem exists. 353.Nm 354prints a "!" after the time if the TTL is <= 1. 355Since vendors ship a lot of obsolete (DEC's Ultrix, Sun 3.x) or 356non-standard (HP-UX) software, expect to see this problem 357frequently and/or take care picking the target host of your 358probes. 359.Pp 360Other possible annotations after the time are 361.Sy !H , 362.Sy !N , 363.Sy !P 364(got a host, network or protocol unreachable, respectively), 365.Sy !A , 366.Sy !C 367(access to the network or host, respectively, is prohibited), 368.Sy !X 369(communication administratively prohibited by filtering), 370.Sy !S 371or 372.Sy !F 373(source route failed or fragmentation needed \- neither of these should 374ever occur and the associated gateway is busted if you see one), 375.Sy !U 376(destination network or host unknown), 377.Sy !T 378(destination network or host unreachable for TOS), 379.Sy !<code> 380(other ICMP unreachable code). 381.Sy TOS=xxx! 382(TOS bit in returned packet differs from last hop). 383If almost all the probes result in some kind of unreachable, 384.Nm 385will give up and exit. 386.Pp 387.Dl $ traceroute -g 10.3.0.5 128.182.0.0 388.Pp 389will show the path from the Cambridge Mailbridge to PSC, while 390.Pp 391.Dl $ traceroute -g 192.5.146.4 -g 10.3.0.5 35.0.0.0 392.Pp 393will show the path from the Cambridge Mailbridge to Merit, using PSC to 394reach the Mailbridge. 395.Pp 396This program is intended for use in network testing, measurement 397and management. 398It should be used primarily for manual fault isolation. 399Because of the load it could impose on the network, it is unwise to use 400.Nm 401during normal operations or from automated scripts. 402.Sh SEE ALSO 403.Xr netstat 1 , 404.Xr ping 8 405.Sh HISTORY 406The very first 407.Nm 408(never released) used ICMP ECHO_REQUEST 409datagrams as probe packets. 410During the first night of testing it was 411discovered that more than half the router vendors of the time would 412not return an ICMP TIME_EXCEEDED for an ECHO_REQUEST. 413.Nm 414was then changed to use UDP probe packets. 415Most modern TCP/IP implementations will now generate an ICMP error 416message to ICMP query messages, and the option to use ECHO_REQUEST probes 417was re-implemented. 418.Pp 419The 420.Nm 421command first appeared in 422.Bx 4.4 . 423The 424.Nm traceroute6 425command first appeared in the WIDE Hydrangea IPv6 protocol stack kit. 426.Sh AUTHORS 427.An -nosplit 428Implemented by 429.An Van Jacobson 430from a suggestion by 431.An Steve Deering . 432Debugged 433by a cast of thousands with particularly cogent suggestions or fixes from 434.An C. Philip Wood , 435.An Tim Seaver , 436and 437.An Ken Adelman . 438