[147390] in North American Network Operators' Group
Re: Traceroute explanation
daemon@ATHENA.MIT.EDU (Raymond Dijkxhoorn)
Thu Dec 8 16:42:16 2011
In-Reply-To: <9A5844D670E44A18B87B629A9E3848C0@work>
From: Raymond Dijkxhoorn <raymond@prolocation.net>
Date: Thu, 8 Dec 2011 22:40:10 +0100
To: Meftah Tayeb <tayeb.meftah@gmail.com>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Hai!
Check with lft or mtr ...=20
Thanks,
Raymond Dijkxhoorn, Prolocation
Op 7 dec. 2011 om 20:56 heeft "Meftah Tayeb" <tayeb.meftah@gmail.com> het vo=
lgende geschreven:
> please tel me how to ?
> i don't know astraceroute:)
>=20
> ----- Original Message ----- From: "Steven Bellovin" <smb@cs.columbia.edu>=
> To: "Meftah Tayeb" <tayeb.meftah@gmail.com>
> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org>
> Sent: Thursday, December 08, 2011 11:33 PM
> Subject: Re: Traceroute explanation
>=20
>=20
> On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
>=20
>> big thank for that
>> but, i am testing that for one day :)
>=20
>=20
>=20
> Can you do an AStraceroute or manually translate those addresses into AS#s=
?
> That is, might level3 and tinet be using multiple AS#s, in which case thi=
s
> isn't unreasonable?
>=20
>=20
>=20
>=20
>=20
>>=20
>>=20
>> ----- Original Message ----- From: "Fred Baker" <fred@cisco.com>
>> To: "Meftah Tayeb" <tayeb.meftah@gmail.com>
>> Cc: <nanog@nanog.org>
>> Sent: Thursday, December 08, 2011 11:23 PM
>> Subject: Re: Traceroute explanation
>>=20
>>=20
>> This is just a guess, but I'll bet the route changed while you were measu=
ring it.
>>=20
>> Traceroute sends a request, awaits a response, sends a request, ... Suppo=
se that the route was
>>=20
>> 172.28.0.1 -> 10.16.0.2
>> -> 41.200.16.1
>> -> 172.17.2.25
>> -> 213.140.58.10
>> -> 195.22.195.125
>> -> 4.69.151.13
>> -> 213.200.68.61
>> -> somewhere else
>>=20
>> and after the test got that far, two systems got inserted into the path b=
efore level3, resulting in the route entering level3 at a different point, 4=
.69.141.249. What you now have is
>>=20
>> 172.28.0.1 -> 10.16.0.2
>> -> 41.200.16.1
>> -> 172.17.2.25
>> -> 213.140.58.10
>> -> 195.22.195.125
>> -> unknown
>> -> unknown
>> -> 4.69.141.249
>> -> 77.67.66.154
>> -> and so on
>>=20
>> The effect would be to get a result like this.
>>=20
>> Next time you see something like this, suggestion: repeat the traceroute a=
nd see what you get.
>>=20
>>=20
>> On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
>>=20
>>> Hey folks,
>>> i see a strange traceroute there
>>>=20
>>> D=C3=A9termination de l'itin=C3=A9raire vers www.rri.ro [193.231.72.52]
>>> avec un maximum de 30 sauts :
>>>=20
>>> 1 2 ms 1 ms 1 ms 172.28.0.1
>>> 2 1 ms 1 ms 1 ms localhost [10.16.0.2]
>>> 3 10 ms 10 ms 13 ms 41.200.16.1
>>> 4 11 ms 10 ms 11 ms 172.17.2.25
>>> 5 21 ms 21 ms 21 ms 213.140.58.10
>>> 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.1=
97.125
>>> ]
>>> 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.15=
1.13]
>>> 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.6=
1]
>>> 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.14=
1.249]
>>> 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154]
>>> 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1]
>>> 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226]=
>>> 13 81 ms 81 ms 81 ms 193.231.72.10
>>> 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.=
90]
>>> 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [19=
3.231.7
>>> 2.52]
>>> Itin=C3=A9raire d=C3=A9termin=C3=A9.
>>> C:\Documents and Settings\TAYEB>
>>> Seabone, then level3, then Tinet, then level3, then tinet ?
>>> if is that a routing stufs that i don't know, please let me know :)
>>> i never saw that befaure
>>>=20
>>> Meftah Tayeb
>>> IT Consulting
>>> http://www.tmvoip.com/
>>> phone: +21321656139
>>> Mobile: +213660347746
>>>=20
>>>=20
>>> __________ Information from ESET NOD32 Antivirus, version of virus signa=
ture database 6695 (20111208) __________
>>>=20
>>> The message was checked by ESET NOD32 Antivirus.
>>>=20
>>> http://www.eset.com
>>>=20
>>=20
>>=20
>>=20
>> __________ Information from ESET NOD32 Antivirus, version of virus signat=
ure database 6695 (20111208) __________
>>=20
>> The message was checked by ESET NOD32 Antivirus.
>>=20
>> http://www.eset.com
>>=20
>>=20
>>=20
>>=20
>> __________ Information from ESET NOD32 Antivirus, version of virus signat=
ure database 6695 (20111208) __________
>>=20
>> The message was checked by ESET NOD32 Antivirus.
>>=20
>> http://www.eset.com
>>=20
>>=20
>>=20
>>=20
>>=20
>=20
>=20
> --Steve Bellovin, https://www.cs.columbia.edu/~smb
>=20
>=20
>=20
>=20
>=20
>=20
>=20
> __________ Information from ESET NOD32 Antivirus, version of virus signatu=
re database 6695 (20111208) __________
>=20
> The message was checked by ESET NOD32 Antivirus.
>=20
> http://www.eset.com
>=20
>=20
>=20
>=20
> __________ Information from ESET NOD32 Antivirus, version of virus signatu=
re database 6695 (20111208) __________
>=20
> The message was checked by ESET NOD32 Antivirus.
>=20
> http://www.eset.com
>=20
>=20
>=20
