[147389] in North American Network Operators' Group
Re: Traceroute explanation
daemon@ATHENA.MIT.EDU (Steven Bellovin)
Thu Dec 8 16:41:36 2011
From: Steven Bellovin <smb@cs.columbia.edu>
In-Reply-To: <9A5844D670E44A18B87B629A9E3848C0@work>
Date: Thu, 8 Dec 2011 16:39:49 -0500
To: "Meftah Tayeb" <tayeb.meftah@gmail.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
I don't know what platform you're using, but there's a separate command. =
See
http://www.shrubbery.net/astraceroute/ . If you're using Linux, there's =
probably
a package in your favorite repository. There seem to be other variants =
floating
around the net. If you're using Windows, I have no idea what's =
available.
On Dec 7, 2011, at 2:56 16PM, Meftah Tayeb wrote:
> please tel me how to ?
> i don't know astraceroute:)
>=20
> ----- Original Message ----- From: "Steven Bellovin" =
<smb@cs.columbia.edu>
> To: "Meftah Tayeb" <tayeb.meftah@gmail.com>
> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org>
> Sent: Thursday, December 08, 2011 11:33 PM
> Subject: Re: Traceroute explanation
>=20
>=20
> On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
>=20
>> big thank for that
>> but, i am testing that for one day :)
>=20
>=20
>=20
> Can you do an AStraceroute or manually translate those addresses into =
AS#s?
> That is, might level3 and tinet be using multiple AS#s, in which case =
this
> isn't unreasonable?
>=20
>=20
>=20
>=20
>=20
>>=20
>>=20
>> ----- Original Message ----- From: "Fred Baker" <fred@cisco.com>
>> To: "Meftah Tayeb" <tayeb.meftah@gmail.com>
>> Cc: <nanog@nanog.org>
>> Sent: Thursday, December 08, 2011 11:23 PM
>> Subject: Re: Traceroute explanation
>>=20
>>=20
>> This is just a guess, but I'll bet the route changed while you were =
measuring it.
>>=20
>> Traceroute sends a request, awaits a response, sends a request, ... =
Suppose that the route was
>>=20
>> 172.28.0.1 -> 10.16.0.2
>> -> 41.200.16.1
>> -> 172.17.2.25
>> -> 213.140.58.10
>> -> 195.22.195.125
>> -> 4.69.151.13
>> -> 213.200.68.61
>> -> somewhere else
>>=20
>> and after the test got that far, two systems got inserted into the =
path before level3, resulting in the route entering level3 at a =
different point, 4.69.141.249. What you now have is
>>=20
>> 172.28.0.1 -> 10.16.0.2
>> -> 41.200.16.1
>> -> 172.17.2.25
>> -> 213.140.58.10
>> -> 195.22.195.125
>> -> unknown
>> -> unknown
>> -> 4.69.141.249
>> -> 77.67.66.154
>> -> and so on
>>=20
>> The effect would be to get a result like this.
>>=20
>> Next time you see something like this, suggestion: repeat the =
traceroute and see what you get.
>>=20
>>=20
>> On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
>>=20
>>> Hey folks,
>>> i see a strange traceroute there
>>>=20
>>> D=E9termination de l'itin=E9raire vers www.rri.ro [193.231.72.52]
>>> avec un maximum de 30 sauts :
>>>=20
>>> 1 2 ms 1 ms 1 ms 172.28.0.1
>>> 2 1 ms 1 ms 1 ms localhost [10.16.0.2]
>>> 3 10 ms 10 ms 13 ms 41.200.16.1
>>> 4 11 ms 10 ms 11 ms 172.17.2.25
>>> 5 21 ms 21 ms 21 ms 213.140.58.10
>>> 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net =
[195.22.197.125
>>> ]
>>> 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net =
[4.69.151.13]
>>> 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net =
[213.200.68.61]
>>> 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net =
[4.69.141.249]
>>> 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net =
[77.67.66.154]
>>> 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1]
>>> 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro =
[81.24.28.226]
>>> 13 81 ms 81 ms 81 ms 193.231.72.10
>>> 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro =
[89.238.225.90]
>>> 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa =
[193.231.7
>>> 2.52]
>>> Itin=E9raire d=E9termin=E9.
>>> C:\Documents and Settings\TAYEB>
>>> Seabone, then level3, then Tinet, then level3, then tinet ?
>>> if is that a routing stufs that i don't know, please let me know :)
>>> i never saw that befaure
>>>=20
>>> Meftah Tayeb
>>> IT Consulting
>>> http://www.tmvoip.com/
>>> phone: +21321656139
>>> Mobile: +213660347746
>>>=20
>>>=20
>>> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>>>=20
>>> The message was checked by ESET NOD32 Antivirus.
>>>=20
>>> http://www.eset.com
>>>=20
>>=20
>>=20
>>=20
>> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>>=20
>> The message was checked by ESET NOD32 Antivirus.
>>=20
>> http://www.eset.com
>>=20
>>=20
>>=20
>>=20
>> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>>=20
>> The message was checked by ESET NOD32 Antivirus.
>>=20
>> http://www.eset.com
>>=20
>>=20
>>=20
>>=20
>>=20
>=20
>=20
> --Steve Bellovin, https://www.cs.columbia.edu/~smb
>=20
>=20
>=20
>=20
>=20
>=20
>=20
> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>=20
> The message was checked by ESET NOD32 Antivirus.
>=20
> http://www.eset.com
>=20
>=20
>=20
>=20
> __________ Information from ESET NOD32 Antivirus, version of virus =
signature database 6695 (20111208) __________
>=20
> The message was checked by ESET NOD32 Antivirus.
>=20
> http://www.eset.com
>=20
>=20
>=20
>=20
--Steve Bellovin, https://www.cs.columbia.edu/~smb
