Lab 1: traceroute

Please read completely before you begin!

This lab should extend your knowledge of connectivity testing and the operation of some TCP/IP basics.

Review traceroute is a utility that will discover the devices on a path from one machine to another. It does this through a clever use of the time-to-live (TTL) field in an IP packet’s header. The TTL field is used to limit the lifetime of a packet. As a packet passes through a router, the field is decremented. When it reaches zero, a router should discard the packet and send a “time exceeded” error message back to the packet’s source. Of course, this error message will have the router’s address as its source address. traceroute works by sending a series of packets with TTL fields of 1, 2, 3, etc. to the destination. Thus each router along the path will send back an error message saying it discarded a packet. traceroute is able to build a list of all the routers on a path to a remote machine by collecting the source addresses from these error messages. traceroute uses an unlikely port number for the destination port so that when the packet finally arrives at its destination, the destination will typically send back an ICMP “port unreachable” error message. Receipt of this message alerts traceroute that it has reached the end of the path. Actually, traceroute sends packets in sets of threes, each with a different port number, just in case one of the randomly selected ports is actually being used.

Lab

For each of the following steps describe your results, give the syntax of the command you used, and, where appropriate, the output produced. Include screen captures as needed in your output. Be sure to label your results carefully and organize your results in the order of steps as given here and to answer each question in your report.

1. Read the Unix manual page for traceroute OR help for tracert under Windows. Experiment with the various options. Describe the three that you found most useful.

2. tracert is known as traceroute under Unix. There are some fundamental differences in how these operate. Both are worth knowing about. Compare Windows and the Unix implementation of TRACEROUTE writing a brief comparison of their differences in syntax and functionality. (optional: Run a trace of a few hops for each of these machines.) Include these in your lab report. Explain briefly the output from each.

3. Open a terminal in Windows and type in the following command and answer the questions

$tracert -d yahoo.com

a. How many hops is your machine away from yahoo.com? (Attach the output in the lab report) b. Wait for a while and execute the same command again. Is the output the same as the first time? (Hint: no) Which hops are changed? Observe and compare the difference, and explain the reason.

4. Looking glasses are web sites that allow you to run simple network analysis programs like ping and traceroute from their sites. The site http://www.bgp4.as/looking-glasses maintains a list of such sites. Visit one of these sites and do a trace to another location. Include a copy of this trace.

By combining the information from two runs of traceroute where the second has the source and destination exchanged, it should be possible to combine the information to create a fairly detailed picture of the network between the two devices.

Acknowledgements: This lab is loosely based on material from Dr. Joseph D. Sloan