1.\" $OpenBSD: traceroute.8,v 1.42 2009/07/06 06:50:03 jmc Exp $ 2.\" $NetBSD: traceroute.8,v 1.6 1995/10/12 03:05:50 mycroft Exp $ 3.\" 4.\" Copyright (c) 1990, 1991, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" This code is derived from software contributed to Berkeley by 8.\" Van Jacobson. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 3. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" @(#)traceroute.8 8.1 (Berkeley) 6/6/93 35.\" 36.Dd $Mdocdate: July 6 2009 $ 37.Dt TRACEROUTE 8 38.Os 39.Sh NAME 40.Nm traceroute 41.Nd print the route packets take to network host 42.Sh SYNOPSIS 43.Nm traceroute 44.Bk -words 45.Op Fl cDdIlnrSv 46.Op Fl f Ar first_ttl 47.Op Fl g Ar gateway_addr 48.Op Fl m Ar max_ttl 49.Op Fl P Ar proto 50.Op Fl p Ar port 51.Op Fl q Ar nqueries 52.Op Fl s Ar src_addr 53.Op Fl t Ar tos 54.Op Fl V Ar rdomain 55.Op Fl w Ar waittime 56.Ar host 57.Op Ar packetsize 58.Ek 59.Sh DESCRIPTION 60The Internet is a large and complex aggregation of 61network hardware, connected together by gateways. 62Tracking the route one's packets follow (or finding the miscreant 63gateway that's discarding your packets) can be difficult. 64.Nm 65utilizes the IP protocol `time to live' field and attempts to elicit an 66.Tn ICMP 67.Dv TIME_EXCEEDED 68response from each gateway along the path to some 69host. 70.Pp 71The only mandatory parameter is the destination host name or IP number. 72The default probe datagram length is 38 bytes, but this may be increased 73by specifying a packet size (in bytes) after the destination host 74name. 75.Pp 76The options are as follows: 77.Bl -tag -width Ds 78.It Fl c 79Do not increment the destination port number in successive UDP packets. 80Rather, all UDP packets will have the same destination port, as set via the 81.Fl p 82flag (or 33434 if none is specified). 83.It Fl D 84Dump the packet data to standard error before transmitting it. 85.It Fl d 86Turn on socket-level debugging. 87.It Fl f Ar first_ttl 88Set the first time-to-live used in outgoing probe packets. 89The effect is that the first first_ttl \- 1 hosts will be skipped 90in the output of 91.Nm traceroute . 92The default value is 1 (skip no hosts). 93.It Fl g Ar gateway_addr 94Add 95.Ar gateway_addr 96to the list of addresses in the IP Loose Source Record Route (LSRR) 97option. 98If no gateways are specified, the LSRR option is omitted. 99.It Fl I 100Equivalent to 101.Fl P 1021. 103Used for compatibility with other OSes. 104.It Fl l 105Display the ttl value of the returned packet. 106This is useful for checking for asymmetric routing. 107.It Fl m Ar max_ttl 108Set the max time-to-live (max number of hops) used in outgoing probe 109packets. 110The default is the value of the system's 111.Cm net.inet.ip.ttl 112MIB variable, which defaults to 64. 113.It Fl n 114Print hop addresses numerically rather than symbolically and numerically 115(saves a nameserver address-to-name lookup for each gateway found on the 116path). 117.It Fl P Ar proto 118Change the protocol being used from 119.Tn UDP 120to a numeric protocol or a name as specified in 121.Pa /etc/protocols . 122This will not work reliably for most protocols. 123If set to 1 (ICMP), then 124ICMP Echo Request messages will be used (same as 125.Xr ping 8 ) . 126.It Fl p Ar port 127Set the base 128.Tn UDP 129.Ar port 130number used in probes (default is 33434). 131.Nm 132hopes that nothing is listening on 133.Tn UDP 134ports 135.Em base 136to 137.Em base+nhops*nqueries-1 138at the destination host (so an 139.Tn ICMP 140.Dv PORT_UNREACHABLE 141message will 142be returned to terminate the route tracing). 143If something is 144listening on a port in the default range, this option can be used 145to pick an unused port range. 146.It Fl q Ar nqueries 147Set the number of probes per ``ttl'' to 148.Ar nqueries 149(default is three probes). 150.It Fl r 151Bypass the normal routing tables and send directly to a host on an attached 152network. 153If the host is not on a directly attached network, 154an error is returned. 155This option corresponds to the 156.Dv SO_DONTROUTE 157socket option; 158it can be used to ping a local host through an interface 159that has no route through it 160(e.g., after the interface was dropped by a routing daemon). 161.It Fl S 162Print how many probes were not answered for each hop. 163.It Fl s Ar src_addr 164Use the following IP address 165(which must be given as an IP number, not 166a hostname) as the source address in outgoing probe packets. 167On hosts with more than one IP address, this option can be used to 168force the source address to be something other than the IP address 169of the interface the probe packet is sent on. 170If the IP address 171is not one of this machine's interface addresses and the user is 172not the superuser, an error is returned and nothing is sent. 173.It Fl t Ar tos 174Set the 175.Em type-of-service 176in probe packets to the following value (default zero). 177The value must be a decimal integer in the range 0 to 255. 178This option can be used to 179see if different types-of-service result in different paths. 180(If you are not running a 181.Bx 4.3 tahoe 182or later system, this may be academic since the normal network 183services like telnet and ftp don't let you control the 184.Dv TOS ) . 185Not all values of 186.Dv TOS 187are legal or 188meaningful \- see the IP spec for definitions. 189Useful values are probably 190.Ql -t 16 191(low delay) and 192.Ql -t 8 193(high throughput). 194.It Fl V Ar rdomain 195Set the routing domain. 196The default is 0. 197.It Fl v 198Verbose output. 199Received 200.Tn ICMP 201packets other than 202.Dv TIME_EXCEEDED 203and 204.Dv UNREACHABLE Ns s 205are listed. 206.It Fl w Ar waittime 207Set the time (in seconds) to wait for a response to a probe (default 5). 208.El 209.Pp 210This program attempts to trace the route an IP packet would follow to some 211internet host by launching 212.Tn UDP 213probe 214packets with a small ttl (time to live) then listening for an 215.Tn ICMP 216"time exceeded" reply from a gateway. 217We start out probes with a ttl of one and increase by one until we get an 218.Tn ICMP 219"port unreachable" 220(which means we got to "host") or hit a max (which 221defaults to 64 hops and can be changed with the 222.Fl m 223flag). 224Three probes (changed with 225.Fl q 226flag) are sent at each ttl setting and a 227line is printed showing the ttl, address of the gateway and 228round trip time of each probe. 229If the probe answers come from 230different gateways, the address of each responding system will 231be printed. 232If there is no response within a 5 second timeout 233interval (changed with the 234.Fl w 235flag), a "*" is printed for that 236probe. 237.Pp 238We don't want the destination 239host to process the 240.Tn UDP 241probe packets so the destination port is set to an 242unlikely value (if some clod on the destination is using that 243value, it can be changed with the 244.Fl p 245flag). 246.Pp 247A sample use and output might be: 248.Bd -literal -offset indent 249$ traceroute nis.nsf.net. 250traceroute to nis.nsf.net (35.1.1.48), 64 hops max, 56 byte packet 2511 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms 2522 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2533 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms 2544 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms 2555 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms 2566 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms 2577 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms 2588 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms 2599 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms 26010 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms 26111 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms 262.Ed 263.Pp 264Note that lines 2 & 3 are the same. 265This is due to a buggy 266kernel on the 2nd hop system \- lbl-csam.arpa \- that forwards 267packets with a zero ttl (a bug in the distributed version 268of 4.3 269.Tn BSD ) . 270Note that you have to guess what path 271the packets are taking cross-country since the 272.Tn NSFNET 273(129.140) 274doesn't supply address-to-name translations for its 275.Tn NSS Ns es . 276.Pp 277A more interesting example is: 278.Bd -literal -offset indent 279$ traceroute allspice.lcs.mit.edu. 280traceroute to allspice.lcs.mit.edu (18.26.0.115), 64 hops max 2811 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 2822 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms 2833 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms 2844 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms 2855 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms 2866 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms 2877 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms 2888 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms 2899 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms 29010 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms 29111 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms 29212 * * * 29313 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms 29414 * * * 29515 * * * 29616 * * * 29717 * * * 29818 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms 299.Ed 300.Pp 301Note that the gateways 12, 14, 15, 16 & 17 hops away 302either don't send 303.Tn ICMP 304"time exceeded" messages or send them 305with a ttl too small to reach us. 30614 \- 17 are running the 307.Tn MIT 308C Gateway code that doesn't send "time exceeded"s. 309God only knows what's going on with 12. 310.Pp 311The silent gateway 12 in the above may be the result of a bug in 312the 4.[23] 313.Tn BSD 314network code (and its derivatives): 4.x (x <= 3) 315sends an unreachable message using whatever ttl remains in the 316original datagram. 317Since, for gateways, the remaining ttl is zero, the 318.Tn ICMP 319"time exceeded" is guaranteed to not make it back to us. 320The behavior of this bug is slightly more interesting 321when it appears on the destination system: 322.Bd -literal -offset indent 3231 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms 3242 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms 3253 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms 3264 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms 3275 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms 3286 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms 3297 * * * 3308 * * * 3319 * * * 33210 * * * 33311 * * * 33412 * * * 33513 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms ! 336.Ed 337.Pp 338Notice that there are 12 "gateways" (13 is the final 339destination) and exactly the last half of them are "missing". 340What's really happening is that rip (a Sun-3 running Sun OS3.5) 341is using the ttl from our arriving datagram as the ttl in its 342.Tn ICMP 343reply. 344So, the reply will time out on the return path 345(with no notice sent to anyone since 346.Tn ICMP's 347aren't sent for 348.Tn ICMP's ) 349until we probe with a ttl that's at least twice the path 350length. 351i.e., rip is really only 7 hops away. 352A reply that returns with a ttl of 1 is a clue this problem exists. 353.Nm 354prints a "!" after the time if the ttl is <= 1. 355Since vendors ship a lot of obsolete 356.Pf ( Tn DEC Ns \'s 357Ultrix, Sun 3.x) or 358non-standard 359.Pq Tn HP-UX 360software, expect to see this problem 361frequently and/or take care picking the target host of your 362probes. 363.Pp 364Other possible annotations after the time are 365.Sy !H , 366.Sy !N , 367.Sy !P 368(got a host, network or protocol unreachable, respectively), 369.Sy !A , 370.Sy !C 371(access to the network or host, respectively, is prohibited), 372.Sy !X 373(communication administratively prohibited by filtering), 374.Sy !S 375or 376.Sy !F 377(source route failed or fragmentation needed \- neither of these should 378ever occur and the associated gateway is busted if you see one), 379.Sy !U 380(destination network or host unknown), 381.Sy !T 382(destination network or host unreachable for TOS), 383.Sy !<code> 384(other ICMP unreachable code). 385If almost all the probes result in some kind of unreachable, 386.Nm 387will give up and exit. 388.Pp 389.Dl $ traceroute -g 10.3.0.5 128.182.0.0 390.Pp 391will show the path from the Cambridge Mailbridge to PSC, while 392.Pp 393.Dl $ traceroute -g 192.5.146.4 -g 10.3.0.5 35.0.0.0 394.Pp 395will show the path from the Cambridge Mailbridge to Merit, using PSC to 396reach the Mailbridge. 397.Pp 398This program is intended for use in network testing, measurement 399and management. 400It should be used primarily for manual fault isolation. 401Because of the load it could impose on the network, it is unwise to use 402.Nm 403during normal operations or from automated scripts. 404.Sh SEE ALSO 405.Xr netstat 1 , 406.Xr ping 8 407.Sh HISTORY 408The very first 409.Nm 410(never released) used ICMP ECHO_REQUEST 411datagrams as probe packets. 412During the first night of testing it was 413discovered that more than half the router vendors of the time would 414not return an ICMP TIME_EXCEEDED for an ECHO_REQUEST. 415.Nm 416was then changed to use UDP probe packets. 417Most modern TCP/IP implementations will now generate an ICMP error 418message to ICMP query messages, and the option to use ECHO_REQUEST probes 419was re-implemented. 420.Pp 421The 422.Nm 423command first appeared in 424.Bx 4.4 . 425.Sh AUTHORS 426Implemented by Van Jacobson from a suggestion by Steve Deering. 427Debugged 428by a cast of thousands with particularly cogent suggestions or fixes from 429C. Philip Wood, Tim Seaver and Ken Adelman. 430