How traceroute Really Works: TTL, ICMP Time-Exceeded, and Mapping a Path Hop by Hop

Originally published at https://blog.pathvector.dev/protocol-lab-trace-19/ — part of the free Protocol Lab series.

This post is part of Protocol Lab, a free, hands-on series for learning networking protocols by building and breaking them in a container lab. All the lab material — topologies, configs, and scripts — lives in the repo: github.com/pathvector-studio/protocol-lab.

Every IP packet carries a TTL (time to live) that each router decrements by one. When it reaches zero, the router drops the packet and sends back an ICMP time-exceeded message. traceroute turns this rule into a map: send probes with TTL 1, 2, 3, … and each dying probe reveals the router at that distance.

Reading guide: rfc-notes/traceroute-ttl.md

Prerequisite: TCP Lab 07: Handshake and Teardown (reading captures)

How traceroute Really Works: TTL, ICMP Time-Exceeded, and Mapping a Path Hop by Hop

Related reading

Package Tracking Was Traceroute All Along — Understanding Route Tracing Through…

ECMP Explained: Two Equal Paths, and the Kernel Hashes Flows Across Them

TCP MSS Clamping: Fixing Path MTU Black Holes by Rewriting the SYN

pingtrace 1.0: why I rewrote from npm to Go

Test network paths with TCP, UDP, and ICMP in Datadog | Datadog

DHCP Explained: How a Machine With No IP Address Gets One in Four Messages