SubnetLayerProtocols

Traceroute: Making Routers Identify Themselves

A tool built entirely out of deliberate failures

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

Before this lesson — it builds directly on:
There is no message in IP that means 'tell me the routers between here and there'. Routers do not advertise themselves to passing traffic, and a packet keeps no record of where it has been. So traceroute takes an obligation and turns it into a tool. Routers are *required* to report a packet whose TTL expires. Send a packet designed to expire at hop 1, and hop 1 must identify itself by complaining. Send one designed to expire at hop 2, and so on. It is a genuinely elegant piece of engineering: information extracted from a system that was never built to provide it.

✗ Common misunderstanding: TTL counts down in seconds, so a packet expires after a certain time.

Why that's wrong: It is decremented once per router, regardless of how long anything took. A packet crossing three hops in a millisecond loses exactly as much TTL as one crossing three hops in a second.

Correct model: TTL is a hop counter. Its only job is to make a looping packet die eventually.

The packets prove it: In the two-hop trace the TTL falls 64 → 63 → 62 across two routers, with no relationship to the elapsed virtual time between them.

Watch these fields in the lab: ipv4.ttl · icmp.type

  1. 1Send a probe with TTL = 1.
  2. 2The first router decrements it to 0, cannot forward it, and discards it.
  3. 3That router must report the expiry, and its report comes from its own address. Hop 1 identified.
  4. 4Send another probe with TTL = 2. It survives the first router and dies at the second. Hop 2 identified.
  5. 5Keep incrementing. Each probe reaches one hop further before expiring.
  6. 6Eventually a probe arrives. The destination answers with a different error type — port unreachable rather than time exceeded — and that change is how the tool knows it has finished.

Watch these fields in the lab: ipv4.ttl · icmp.code

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

What would happen to traceroute if routers stopped sending Time Exceeded messages?

Hop 6 shows 200 ms, but hops 7 through 12 all show 20 ms. What is going on?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.