1.\" $OpenBSD: traceroute.8,v 1.69 2020/02/11 18:41:39 deraadt Exp $ 2.\" $NetBSD: traceroute.8,v 1.6 1995/10/12 03:05:50 mycroft Exp $ 3.\" 4.\" Copyright (c) 1990, 1991, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" This code is derived from software contributed to Berkeley by 8.\" Van Jacobson. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" @(#)traceroute.8 8.1 (Berkeley) 6/6/93 35.\" 36.Dd $Mdocdate: February 11 2020 $ 37.Dt TRACEROUTE 8 38.Os 39.Sh NAME 40.Nm traceroute , 41.Nm traceroute6 42.Nd print the route packets take to network host 43.Sh SYNOPSIS 44.Nm traceroute\ \& 45.Op Fl AcDdIlnSvx 46.Op Fl f Ar first_ttl 47.Op Fl g Ar gateway_addr 48.Op Fl m Ar max_ttl 49.Op Fl P Ar proto 50.Op Fl p Ar port 51.Op Fl q Ar nqueries 52.Op Fl s Ar sourceaddr 53.Op Fl t Ar toskeyword 54.Op Fl V Ar rtable 55.Op Fl w Ar waittime 56.Ar host 57.Op Ar datalen 58.Nm traceroute6 59.Op Fl AcDdIlnSv 60.Op Fl f Ar first_hop 61.Op Fl m Ar max_hop 62.Op Fl p Ar port 63.Op Fl q Ar nqueries 64.Op Fl s Ar sourceaddr 65.Op Fl t Ar toskeyword 66.Op Fl V Ar rtable 67.Op Fl w Ar waittime 68.Ar host 69.Op Ar datalen 70.Sh DESCRIPTION 71The Internet is a large and complex aggregation of 72network hardware, connected together by gateways. 73Tracking the route packets follow (or finding the miscreant 74gateway that's discarding packets) can be difficult. 75.Nm 76and 77.Nm traceroute6 78attempt to elicit 79.Dv TIME_EXCEEDED 80responses from each gateway along the path to 81.Ar host , 82in order to determine their route. 83.Nm 84is used for IPv4 networks and 85.Nm traceroute6 86for IPv6. 87.Pp 88The options are as follows: 89.Bl -tag -width Ds 90.It Fl A 91Look up the AS number for each hop address. 92Uses the DNS service described at 93.Lk https://www.team-cymru.com/IP-ASN-mapping.html#dns 94.It Fl c 95Do not increment the destination port number in successive UDP packets. 96Rather, all UDP packets will have the same destination port, as set via the 97.Fl p 98flag (or 33434 if none is specified). 99.It Fl D 100Dump the packet data to standard error before transmitting it. 101.It Fl d 102Turn on socket-level debugging. 103.It Fl f Ar first_ttl 104Set the first TTL or hop limit used in outgoing probe packets. 105The effect is that the first first_ttl \- 1 hosts will be skipped 106in the output of 107.Nm traceroute . 108The default is 1 (skip no hosts). 109.It Fl g Ar gateway_addr 110Add 111.Ar gateway_addr 112to the list of addresses in the IP Loose Source Record Route (LSRR) 113option. 114If no gateways are specified, the LSRR option is omitted. 115This option is not available for IPv6. 116.It Fl I 117Use ICMP or ICMP6 ECHO instead of UDP datagrams. 118.It Fl l 119Display the TTL or hop limit value of the returned packet. 120This is useful for checking for asymmetric routing. 121.It Fl m Ar max_ttl 122Set the maximum TTL or hop limit. 123The default is the value of the system's 124.Va net.inet.ip.ttl 125or 126.Va net.inet6.ip6.hlim 127.Xr sysctl 8 128variable, which defaults to 64. 129.It Fl n 130Print hop addresses numerically rather than symbolically and numerically 131(saves a nameserver address-to-name lookup for each gateway found on the 132path). 133.It Fl P Ar proto 134Change the protocol being used from UDP 135to a numeric protocol or a name as specified in 136.Pa /etc/protocols . 137This will not work reliably for most protocols. 138If set to 1 (ICMP), then 139ICMP Echo Request messages will be used (same as 140.Xr ping 8 ) . 141This option is not available for IPv6. 142.It Fl p Ar port 143Set the base UDP 144.Ar port 145number used in probes. 146The default is 33434. 147.Nm 148hopes that nothing is listening on UDP ports 149.Ar base 150to 151.Ar base Ns + Ns Ar nhops Ns * Ns Ar nqueries Ns -1 152at the destination host (so an ICMP 153.Dv PORT_UNREACHABLE 154message will 155be returned to terminate the route tracing). 156If something is 157listening on a port in the default range, this option can be used 158to pick an unused port range. 159.It Fl q Ar nqueries 160Set the number of probes per TTL to 161.Ar nqueries . 162The default is three probes. 163.It Fl S 164Print how many probes were not answered for each hop. 165.It Fl s Ar sourceaddr 166Set the source address to transmit from, which is useful on machines 167with multiple interfaces. 168.It Fl t Ar toskeyword 169Set the type-of-service (TOS) in probe packets. 170The value may be one of 171.Cm critical , 172.Cm inetcontrol , 173.Cm lowdelay , 174.Cm netcontrol , 175.Cm throughput , 176.Cm reliability , 177or one of the DiffServ Code Points: 178.Cm ef , 179.Cm af11 ... af43 , 180.Cm cs0 ... cs7 ; 181or a number in either hex or decimal. 182The default is zero. 183This option can be used to 184see if different types-of-service result in different paths. 185If this option is used, changes to the type-of-service in the 186returned packets are displayed. 187Not all values of TOS are legal or meaningful \- 188see the IP spec for definitions. 189Useful values are probably 190.Cm lowdelay 191and 192.Cm throughput . 193.It Fl V Ar rtable 194Set the routing table to be used. 195.It Fl v 196Verbose output. 197Received ICMP packets other than 198.Dv TIME_EXCEEDED 199and 200.Dv UNREACHABLE Ns s 201are listed. 202.It Fl w Ar waittime 203Set the time, in seconds, to wait for a response to a probe. 204The default is 5. 205.It Fl x 206Print the ICMP extended headers if available. 207This option is not available for IPv6. 208.It Ar host 209The destination host, 210specified as a host name or numeric IP address. 211.It Ar datalen 212The probe datagram length. 213The default is 40 bytes for IPv4 UDP 214and 60 bytes for ICMP, IPv6 UDP and ICMP6. 215.El 216.Pp 217The program attempts to trace the route an IP packet would follow to a 218host by launching UDP probe packets with a small TTL or hop limit, 219then listening for an ICMP "time exceeded" reply from a gateway. 220It starts using probes with a TTL/hop limit of one 221and increases by one until it gets an ICMP "port unreachable" 222(which means it reached the host) or hits a maximum limit 223(which defaults to 64, but can be changed using the 224.Fl m 225option). 226Three probes (the exact number can be changed using the 227.Fl q 228option) are sent and a line is printed 229showing the TTL or hop limit, address of the gateway, 230and round trip time of each probe. 231If the probe answers come from different gateways, 232the address of each responding system will be printed. 233If there is no response within a 5 second timeout 234interval (which can be changed using the 235.Fl w 236option), a "*" is printed for that 237probe. 238.Pp 239We don't want the destination 240host to process the UDP 241probe packets so the destination port is set to an 242unlikely value (if some clod on the destination is using that 243value, it can be changed using the 244.Fl p 245option). 246.Pp 247A sample use and output might be: 248.Bd -literal -offset indent 249$ traceroute nis.nsf.net. 250traceroute to nis.nsf.net (35.1.1.48), 64 hops max, 56 byte packet 2511 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms 2522 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2533 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2544 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms 2555 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms 2566 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms 2577 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms 2588 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms 2599 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms 26010 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms 26111 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms 262.Ed 263.Pp 264Note that lines 2 & 3 are the same. 265This is due to a buggy 266kernel on the 2nd hop system \- lbl-csam.arpa \- that forwards 267packets with a zero TTL (a bug in the distributed version of 268.Bx 4.3 ) . 269Note that you have to guess what path 270the packets are taking cross-country since the NSFNET (129.140) 271doesn't supply address-to-name translations for its NSSes. 272.Pp 273A more interesting example is: 274.Bd -literal -offset indent 275$ traceroute allspice.lcs.mit.edu. 276traceroute to allspice.lcs.mit.edu (18.26.0.115), 64 hops max 2771 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 2782 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms 2793 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms 2804 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms 2815 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms 2826 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms 2837 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms 2848 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms 2859 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms 28610 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms 28711 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms 28812 * * * 28913 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms 29014 * * * 29115 * * * 29216 * * * 29317 * * * 29418 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms 295.Ed 296.Pp 297Note that the gateways 12, 14, 15, 16 & 17 hops away 298either don't send ICMP "time exceeded" messages or send them 299with a TTL too small to reach us. 30014 \- 17 are running the MIT 301C Gateway code that doesn't send "time exceeded"s. 302God only knows what's going on with 12. 303.Pp 304The silent gateway 12 in the above may be the result of a bug in 305the 4.[23] 306.Bx 307network code (and its derivatives): 4.x (x <= 3) 308sends an unreachable message using whatever TTL remains in the 309original datagram. 310Since, for gateways, the remaining TTL is zero, the ICMP 311"time exceeded" is guaranteed to not make it back to us. 312The behavior of this bug is slightly more interesting 313when it appears on the destination system: 314.Bd -literal -offset indent 3151 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 3162 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms 3173 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms 3184 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms 3195 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms 3206 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms 3217 * * * 3228 * * * 3239 * * * 32410 * * * 32511 * * * 32612 * * * 32713 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms ! 328.Ed 329.Pp 330Notice that there are 12 "gateways" (13 is the final 331destination) and exactly the last half of them are "missing". 332What's really happening is that rip (a Sun-3 running Sun OS3.5) 333is using the TTL from our arriving datagram as the TTL in its 334ICMP reply. 335So, the reply will time out on the return path 336(with no notice sent to anyone since ICMPs aren't sent for ICMPs) 337until we probe with a TTL that's at least twice the path 338length. 339That is, rip is really only 7 hops away. 340A reply that returns with a TTL of 1 is a clue this problem exists. 341.Nm 342prints a "!" after the time if the TTL is <= 1. 343Since vendors ship a lot of obsolete (DEC's Ultrix, Sun 3.x) or 344non-standard (HP-UX) software, expect to see this problem 345frequently and/or take care picking the target host of your 346probes. 347.Pp 348Other possible annotations after the time are 349.Sy !H , 350.Sy !N , 351.Sy !P 352(got a host, network or protocol unreachable, respectively), 353.Sy !A , 354.Sy !C 355(access to the network or host, respectively, is prohibited), 356.Sy !X 357(communication administratively prohibited by filtering), 358.Sy !S 359or 360.Sy !F 361(source route failed or fragmentation needed \- neither of these should 362ever occur and the associated gateway is busted if you see one), 363.Sy !U 364(destination network or host unknown), 365.Sy !T 366(destination network or host unreachable for TOS), 367.Sy !<code> 368(other ICMP unreachable code). 369.Sy TOS=xxx! 370(TOS bit in returned packet differs from last hop). 371If almost all the probes result in some kind of unreachable, 372.Nm 373will give up and exit. 374.Pp 375.Dl $ traceroute -g 10.3.0.5 128.182.0.0 376.Pp 377will show the path from the Cambridge Mailbridge to PSC, while 378.Pp 379.Dl $ traceroute -g 192.5.146.4 -g 10.3.0.5 35.0.0.0 380.Pp 381will show the path from the Cambridge Mailbridge to Merit, using PSC to 382reach the Mailbridge. 383.Pp 384This program is intended for use in network testing, measurement 385and management. 386It should be used primarily for manual fault isolation. 387Because of the load it could impose on the network, it is unwise to use 388.Nm 389during normal operations or from automated scripts. 390.Sh SEE ALSO 391.Xr netstat 1 , 392.Xr ping 8 393.Sh HISTORY 394The very first 395.Nm 396(never released) used ICMP ECHO_REQUEST 397datagrams as probe packets. 398During the first night of testing it was 399discovered that more than half the router vendors of the time would 400not return an ICMP TIME_EXCEEDED for an ECHO_REQUEST. 401.Nm 402was then changed to use UDP probe packets. 403Most modern TCP/IP implementations will now generate an ICMP error 404message to ICMP query messages, and the option to use ECHO_REQUEST probes 405was re-implemented. 406.Pp 407The 408.Nm 409command first appeared in 410.Bx 4.4 . 411The 412.Nm traceroute6 413command first appeared in the WIDE Hydrangea IPv6 protocol stack kit. 414.Sh AUTHORS 415.An -nosplit 416Implemented by 417.An Van Jacobson 418from a suggestion by 419.An Steve Deering . 420Debugged 421by a cast of thousands with particularly cogent suggestions or fixes from 422.An C. Philip Wood , 423.An Tim Seaver , 424and 425.An Ken Adelman . 426