[147388] in North American Network Operators' Group
Re: Traceroute explanation
daemon@ATHENA.MIT.EDU (Harsha V. Madhyastha)
Thu Dec 8 16:39:03 2011
From: "Harsha V. Madhyastha" <harsha@cs.ucr.edu>
In-Reply-To: <E5169CA8-4554-41FA-9F34-F46ADD271F6C@cisco.com>
Date: Thu, 8 Dec 2011 13:37:11 -0800
To: Fred Baker <fred@cisco.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Another explanation could be load balancing. As Fred mentioned, =
traceroute sends out different packets for different hops on the path =
and since these packets have different headers, load balancers on the =
path may hash packets with different TTL values on to different paths.
Check out http://www.paris-traceroute.net/ for more information.
--Harsha
On Dec 8, 2011, at 1:23 PM, Fred Baker wrote:
> This is just a guess, but I'll bet the route changed while you were =
measuring it.
>=20
> Traceroute sends a request, awaits a response, sends a request, ... =
Suppose that the route was
>=20
> 172.28.0.1 -> 10.16.0.2
> -> 41.200.16.1
> -> 172.17.2.25
> -> 213.140.58.10
> -> 195.22.195.125
> -> 4.69.151.13
> -> 213.200.68.61
> -> somewhere else
>=20
> and after the test got that far, two systems got inserted into the =
path before level3, resulting in the route entering level3 at a =
different point, 4.69.141.249. What you now have is
>=20
> 172.28.0.1 -> 10.16.0.2
> -> 41.200.16.1
> -> 172.17.2.25
> -> 213.140.58.10
> -> 195.22.195.125
> -> unknown
> -> unknown
> -> 4.69.141.249
> -> 77.67.66.154
> -> and so on
>=20
> The effect would be to get a result like this.
>=20
> Next time you see something like this, suggestion: repeat the =
traceroute and see what you get.
>=20
>=20
> On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
>=20
>> Hey folks,
>> i see a strange traceroute there
>>=20
>> D=E9termination de l'itin=E9raire vers www.rri.ro [193.231.72.52]
>> avec un maximum de 30 sauts :
>>=20
>> 1 2 ms 1 ms 1 ms 172.28.0.1
>> 2 1 ms 1 ms 1 ms localhost [10.16.0.2]
>> 3 10 ms 10 ms 13 ms 41.200.16.1
>> 4 11 ms 10 ms 11 ms 172.17.2.25
>> 5 21 ms 21 ms 21 ms 213.140.58.10
>> 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net =
[195.22.197.125
>> ]
>> 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net =
[4.69.151.13]
>> 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net =
[213.200.68.61]
>> 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net =
[4.69.141.249]
>> 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net =
[77.67.66.154]
>> 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1]
>> 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro =
[81.24.28.226]
>> 13 81 ms 81 ms 81 ms 193.231.72.10
>> 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro =
[89.238.225.90]
>> 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa =
[193.231.7
>> 2.52]
>> Itin=E9raire d=E9termin=E9.
>> C:\Documents and Settings\TAYEB>
>> Seabone, then level3, then Tinet, then level3, then tinet ?
>> if is that a routing stufs that i don't know, please let me know :)
>> i never saw that befaure
>>=20
>> Meftah Tayeb
>> IT Consulting
>> http://www.tmvoip.com/=20
>> phone: +21321656139
>> Mobile: +213660347746
>>=20
>>=20
>> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>>=20
>> The message was checked by ESET NOD32 Antivirus.
>>=20
>> http://www.eset.com
>>=20
>=20
>=20
