1 .\" $OpenBSD: traceroute.8,v 1.36 2003/08/27 08:17:33 jmc Exp $
2 .\" $NetBSD: traceroute.8,v 1.6 1995/10/12 03:05:50 mycroft Exp $
4 .\" Copyright (c) 1990, 1991, 1993
5 .\" The Regents of the University of California. All rights reserved.
7 .\" This code is derived from software contributed to Berkeley by
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
18 .\" 3. Neither the name of the University nor the names of its contributors
19 .\" may be used to endorse or promote products derived from this software
20 .\" without specific prior written permission.
22 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 .\" @(#)traceroute.8 8.1 (Berkeley) 6/6/93
36 .\" $DragonFly: src/usr.sbin/traceroute/traceroute.8,v 1.3 2006/02/28 03:25:11 swildner Exp $
42 .Nd print the route packets take to network host
48 .Op Fl g Ar gateway_addr
60 The Internet is a large and complex aggregation of
61 network hardware, connected together by gateways.
62 Tracking the route one's packets follow (or finding the miscreant
63 gateway that's discarding your packets) can be difficult.
65 utilizes the IP protocol `time to live' field and attempts to elicit an
68 response from each gateway along the path to some
71 The only mandatory parameter is the destination host name or IP number.
72 The default probe datagram length is 38 bytes, but this may be increased
73 by specifying a packet size (in bytes) after the destination host
76 The options are as follows:
79 Do not increment the destination port number in successive UDP packets.
80 Rather, all UDP packets will have the same destination port, as set via the
82 flag (or 33434 if none is specified).
84 Turn on socket-level debugging.
86 Dump the packet data to standard error before transmitting it.
88 Set the first time-to-live used in outgoing probe packets. The effect is that
89 the first first_ttl - 1 hosts will be skipped in the output of
91 The default value is 1 (skip no hosts).
92 .It Fl g Ar gateway_addr
95 to the list of addresses in the IP Loose Source Record Route (LSRR)
97 If no gateways are specified, the LSRR option is omitted.
102 Used for compatibility with other OSes.
104 Display the ttl value of the returned packet.
105 This is useful for checking for asymmetric routing.
107 Set the max time-to-live (max number of hops) used in outgoing probe
109 The default is the value of the system's
111 MIB variable, which defaults to 64.
113 Print hop addresses numerically rather than symbolically and numerically
114 (saves a nameserver address-to-name lookup for each gateway found on the
120 number used in probes (default is 33434).
122 hopes that nothing is listening on
127 .Em base+nhops*nqueries-1
128 at the destination host (so an
132 be returned to terminate the route tracing).
134 listening on a port in the default range, this option can be used
135 to pick an unused port range.
137 Change the protocol being used from
139 to a numeric protocol or a name as specified in
141 This will not work reliably for most protocols.
142 If set to 1 (ICMP), then
143 ICMP Echo Request messages will be used (same as
146 Set the number of probes per ``ttl'' to
148 (default is three probes).
150 Bypass the normal routing tables and send directly to a host on an attached
152 If the host is not on a directly attached network,
153 an error is returned.
154 This option can be used to ping a local host through an interface
155 that has no route through it (e.g., after the interface was dropped by
158 Use the following IP address
159 (which must be given as an IP number, not
160 a hostname) as the source address in outgoing probe packets.
161 On hosts with more than one IP address, this option can be used to
162 force the source address to be something other than the IP address
163 of the interface the probe packet is sent on.
165 is not one of this machine's interface addresses and the user is
166 not the superuser, an error is returned and nothing is sent.
168 Print how many probes were not answered for each hop.
172 in probe packets to the following value (default zero).
173 The value must be a decimal integer in the range 0 to 255.
174 This option can be used to
175 see if different types-of-service result in different paths.
176 (If you are not running a
178 or later system, this may be academic since the normal network
179 services like telnet and ftp don't let you control the
184 meaningful \- see the IP spec for definitions.
185 Useful values are probably
200 Set the time (in seconds) to wait for a response to a probe (default 3).
203 This program attempts to trace the route an IP packet would follow to some
204 internet host by launching
207 packets with a small ttl (time to live) then listening for an
209 "time exceeded" reply from a gateway.
210 We start out probes with a ttl of one and increase by one until we get an
213 (which means we got to "host") or hit a max (which
214 defaults to 64 hops and can be changed with the
217 Three probes (changed with
219 flag) are sent at each ttl setting and a
220 line is printed showing the ttl, address of the gateway and
221 round trip time of each probe.
222 If the probe answers come from
223 different gateways, the address of each responding system will
225 If there is no response within a 5 sec. timeout
226 interval (changed with the
228 flag), a "*" is printed for that
231 We don't want the destination
234 probe packets so the destination port is set to an
235 unlikely value (if some clod on the destination is using that
236 value, it can be changed with the
240 A sample use and output might be:
241 .Bd -literal -offset indent
242 $ traceroute nis.nsf.net.
243 traceroute to nis.nsf.net (35.1.1.48), 64 hops max, 56 byte packet
244 1 helios.ee.lbl.gov (128.3.112.1) 19 ms 19 ms 0 ms
245 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms
246 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 39 ms 19 ms
247 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 39 ms
248 5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 39 ms 39 ms 39 ms
249 6 128.32.197.4 (128.32.197.4) 40 ms 59 ms 59 ms
250 7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 59 ms
251 8 129.140.70.13 (129.140.70.13) 99 ms 99 ms 80 ms
252 9 129.140.71.6 (129.140.71.6) 139 ms 239 ms 319 ms
253 10 129.140.81.7 (129.140.81.7) 220 ms 199 ms 199 ms
254 11 nic.merit.edu (35.1.1.48) 239 ms 239 ms 239 ms
257 Note that lines 2 & 3 are the same.
258 This is due to a buggy
259 kernel on the 2nd hop system \- lilac-dmc.Berkeley.EDU \- that forwards
260 packets with a zero ttl (a bug in the distributed version
263 Note that you have to guess what path
264 the packets are taking cross-country since the
267 doesn't supply address-to-name translations for its
270 A more interesting example is:
271 .Bd -literal -offset indent
272 $ traceroute allspice.lcs.mit.edu.
273 traceroute to allspice.lcs.mit.edu (18.26.0.115), 64 hops max
274 1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms
275 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 19 ms 19 ms
276 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 19 ms
277 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 19 ms 39 ms 39 ms
278 5 ccn-nerif22.Berkeley.EDU (128.32.168.22) 20 ms 39 ms 39 ms
279 6 128.32.197.4 (128.32.197.4) 59 ms 119 ms 39 ms
280 7 131.119.2.5 (131.119.2.5) 59 ms 59 ms 39 ms
281 8 129.140.70.13 (129.140.70.13) 80 ms 79 ms 99 ms
282 9 129.140.71.6 (129.140.71.6) 139 ms 139 ms 159 ms
283 10 129.140.81.7 (129.140.81.7) 199 ms 180 ms 300 ms
284 11 129.140.72.17 (129.140.72.17) 300 ms 239 ms 239 ms
286 13 128.121.54.72 (128.121.54.72) 259 ms 499 ms 279 ms
291 18 ALLSPICE.LCS.MIT.EDU (18.26.0.115) 339 ms 279 ms 279 ms
294 Note that the gateways 12, 14, 15, 16 & 17 hops away
297 "time exceeded" messages or send them
298 with a ttl too small to reach us.
299 14 \- 17 are running the
301 C Gateway code that doesn't send "time exceeded"s.
302 God only knows what's going on with 12.
304 The silent gateway 12 in the above may be the result of a bug in
307 network code (and its derivatives): 4.x (x \(<= 3)
308 sends an unreachable message using whatever ttl remains in the
310 Since, for gateways, the remaining ttl is zero, the
312 "time exceeded" is guaranteed to not make it back to us.
313 The behavior of this bug is slightly more interesting
314 when it appears on the destination system:
315 .Bd -literal -offset indent
316 1 helios.ee.lbl.gov (128.3.112.1) 0 ms 0 ms 0 ms
317 2 lilac-dmc.Berkeley.EDU (128.32.216.1) 39 ms 19 ms 39 ms
318 3 lilac-dmc.Berkeley.EDU (128.32.216.1) 19 ms 39 ms 19 ms
319 4 ccngw-ner-cc.Berkeley.EDU (128.32.136.23) 39 ms 40 ms 19 ms
320 5 ccn-nerif35.Berkeley.EDU (128.32.168.35) 39 ms 39 ms 39 ms
321 6 csgw.Berkeley.EDU (128.32.133.254) 39 ms 59 ms 39 ms
328 13 rip.Berkeley.EDU (128.32.131.22) 59 ms ! 39 ms ! 39 ms !
331 Notice that there are 12 "gateways" (13 is the final
332 destination) and exactly the last half of them are "missing".
333 What's really happening is that rip (a Sun-3 running Sun OS3.5)
334 is using the ttl from our arriving datagram as the ttl in its
337 So, the reply will time out on the return path
338 (with no notice sent to anyone since
342 until we probe with a ttl that's at least twice the path
344 i.e., rip is really only 7 hops away.
345 A reply that returns with a ttl of 1 is a clue this problem exists.
347 prints a "!" after the time if the ttl is \(<= 1.
348 Since vendors ship a lot of obsolete
353 software, expect to see this problem
354 frequently and/or take care picking the target host of your
357 Other possible annotations after the time are
361 (got a host, network or protocol unreachable, respectively),
364 (access to the network or host, respectively, is prohibited),
366 (communication administratively prohibited by filtering),
370 (source route failed or fragmentation needed \- neither of these should
371 ever occur and the associated gateway is busted if you see one),
373 (destination network or host unknown),
375 (destination network or host unreachable for TOS),
377 (other ICMP unreachable code).
378 If almost all the probes result in some kind of unreachable,
380 will give up and exit.
382 .Dl $ traceroute -g 10.3.0.5 128.182.0.0
384 will show the path from the Cambridge Mailbridge to PSC, while
386 .Dl $ traceroute -g 192.5.146.4 -g 10.3.0.5 35.0.0.0
388 will show the path from the Cambridge Mailbridge to Merit, using PSC to
389 reach the Mailbridge.
391 This program is intended for use in network testing, measurement
393 It should be used primarily for manual fault isolation.
394 Because of the load it could impose on the network, it is unwise to use
396 during normal operations or from automated scripts.
403 (never released) used ICMP ECHO_REQUEST
404 datagrams as probe packets. During the first night of testing it was
405 discovered that more than half the router vendors of the time would
406 not return an ICMP TIME_EXCEEDED for an ECHO_REQUEST.
408 was then changed to use UDP probe packets.
409 Most modern TCP/IP implementations will now generate an ICMP error
410 message to ICMP query messages, and the option to use ECHO_REQUEST probes
415 command first appeared in
418 Implemented by Van Jacobson from a suggestion by Steve Deering.
420 by a cast of thousands with particularly cogent suggestions or fixes from
421 C. Philip Wood, Tim Seaver and Ken Adelman.