SoftwaretracerouteICMPTTLVan Jacobsontech history
Traceroute maps a network path with packets set to expire, then reads the ICMP time-exceeded reply from each router that kills one
Berkeley's version was written by Van Jacobson on a suggestion from Steve Deering. A 1993 RFC later proposed replacing the trick with a new IP option, and its first section explains what the trick had going for it.
Every IP packet carries a time-to-live field, a counter that each router lowers by one. It exists to stop packets from circling the network forever: when the counter runs out, the router throws the packet away and sends an error back to whoever sent it. Traceroute takes that safety feature and uses it as a survey tool.
RFC 1393, written by Gary Scott Malkin in January 1993, describes the method in a section called “Traceroute Today”: “The existing traceroute operates by sending out a packet with a Time To Live (TTL) of 1.” Then: “The first hop then sends back an ICMP [1] error message indicating that the packet could not be forwarded.” That reply carries the first router’s address. Send the next packet with a TTL of 2 and the second router is the one that has to give up, and so on until you’ve listed every router on the way. The route is the list of everyone who killed one of your packets.
The Berkeley man page says the same in its own words. Traceroute “utilizes the IP protocol ‘time to live’ field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host.” And it credits a person: “Implemented by Van Jacobson from a suggestion by Steve Deering.” Mike Muuss, who wrote ping, once admitted he was jealous of the result; that story is in our ping piece.
The end of the trip needs its own trick. A packet that reaches the destination alive doesn’t expire, so nothing sends an error. The man page’s answer is to aim the probes at a UDP port that nobody uses. The default base port is 33434, and the text says, “Traceroute hopes that nothing is listening” on those ports. When the destination gets a packet for a port with no listener, it replies with a port-unreachable error, and that is how traceroute knows the trace is over. It’s a tool that depends on a locked door to know it has arrived.
The most useful bit is the stars. The man page describes an asterisk as a probe with “no response within a 3 sec. timeout interval.” That’s all it says: no answer came back in time. It doesn’t say the router is down, since a router can forward traffic perfectly well and still never answer your expired packet. A line of stars in a trace means a reply didn’t reach you.
RFC 1393 itself exists because the original method is wasteful. Malkin proposed a new IP option that would let a router report back along the whole path, logging it in n+1 packets instead of the 2n the old way needs. That proposal had a cost: routers would need new code. And he named the thing that made the original so durable: “The advantage of this algorithm, is that every router already has the ability to send TTL exceeded messages.”
“No special code is required.”