Traceroute command not working on Ubuntu

The traceroute utility can be installed from synaptic :

$ sudo apt-get install traceroute

Some Information :

$ traceroute -V
Modern traceroute for Linux, version 2.0.15, Oct 17 2010
Copyright (c) 2008  Dmitry Butskoy,   License: GPL v2 or any later

Doing some test runs

$ traceroute www.google.com
traceroute to www.google.com (74.125.235.20), 30 hops max, 60 byte packets
 1  192.168.0.1 (192.168.0.1)  1.545 ms  1.759 ms  2.771 ms
 2  10.10.145.1 (10.10.145.1)  11.986 ms  12.214 ms *
 3  * * *
 4  * * *
 5  * * *
 6  * 121.240.1.38 (121.240.1.38)  58.080 ms  43.995 ms
 7  209.85.241.52 (209.85.241.52)  44.342 ms  44.650 ms  45.224 ms
 8  209.85.251.95 (209.85.251.95)  57.145 ms * *
 9  * * *
10  * * *
11  * * sin01s04-in-f20.1e100.net (74.125.235.20)  86.774 ms

The traceroute command by default sends UDP packets. In the above output 5 network nodes remain undiscovered. The first impression would be that they did not repsond. However this is not the case. Wireshark reveals more :

Wireshark clearly shows ICMP ttl expired reply from nodes :

203.171.242.33
203.171.240.17

But these nodes dont show up in the traceroute output.

ICMP Packets

$ sudo traceroute -I www.google.com
traceroute to www.google.com (74.125.235.18), 30 hops max, 60 byte packets
 1  192.168.0.1 (192.168.0.1)  1.669 ms  1.854 ms *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * 121.240.1.38 (121.240.1.38)  46.742 ms  46.686 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * sin01s04-in-f18.1e100.net (74.125.235.18)  88.562 ms

The program needs super privileges for ICMP packets ? Why ?
The icmp output has even lesser nodes. Wireshark screenshot :

This time most nodes have replied which include :

209.85.241.52
209.85.241.95








66.249.94.74
72.14.233.107

But none of these are shown in the terminal output.

TCP Packets

$ sudo traceroute -T www.google.com
traceroute to www.google.com (74.125.235.17), 30 hops max, 44 byte packets
 1  192.168.0.1 (192.168.0.1)  1.326 ms  1.897 ms *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * 121.240.1.38 (121.240.1.38)  45.706 ms *
 7  209.85.241.52 (209.85.241.52)  45.778 ms * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  sin01s04-in-f17.1e100.net (74.125.235.17)  87.486 ms  87.995 ms  89.563 ms

There are more and more ICMP replies to TCP scans , as we can see in wireshark :

Windows

C:\>tracert www.google.com

Tracing route to www.l.google.com [74.125.235.17]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2     1 ms     1 ms     1 ms  192.168.0.1
  3     3 ms     3 ms     2 ms  10.10.145.1
  4    56 ms    74 ms    82 ms  203.171.242.33
  5     3 ms     3 ms     3 ms  203.171.240.17
  6    17 ms    74 ms    82 ms  203.171.240.1
  7    43 ms    43 ms    43 ms  121.240.1.38
  8    87 ms    43 ms    43 ms  209.85.241.52
  9   105 ms    83 ms    76 ms  209.85.251.95
 10    95 ms    95 ms   118 ms  66.249.94.74
 11    95 ms    95 ms   105 ms  72.14.233.107
 12    97 ms   158 ms    86 ms  sin01s04-in-f17.1e100.net [74.125.235.17]

Trace complete.

traceroute-nanog

The traceroute-nanog command is slightly better. Install from synaptic :

$ sudo apt-get install traceroute-nanog

Run

$ traceroute-nanog www.google.com
traceroute to www.google.com (74.125.235.17), 30 hops max, 60 byte packets
 1  192.168.0.1 (192.168.0.1)  1.749 ms  1.143 ms  1.128 ms
 2  10.10.145.1 (10.10.145.1)  3.753 ms  4.272 ms  2.839 ms
 3  203.171.242.33 (203.171.242.33)  77.158 ms  85.810 ms  3.331 ms
 4  203.171.240.17 (203.171.240.17)  3.758 ms  71.360 ms  3.262 ms
 5  203.171.240.1 (203.171.240.1)  5.156 ms  72.207 ms  5.093 ms
 6  121.240.1.38 (121.240.1.38)  44.575 ms  44.703 ms  44.452 ms
 7  209.85.241.52 (209.85.241.52)  44.021 ms  53.894 ms  43.449 ms
 8  209.85.251.95 (209.85.251.95)  56.977 ms  55.171 ms  55.243 ms
 9  66.249.94.74 (66.249.94.74)  173.910 ms  149.952 ms  95.487 ms
10  72.14.233.107 (72.14.233.107)  95.395 ms  95.405 ms  96.109 ms
11  sin01s04-in-f17.1e100.net (74.125.235.17)  86.733 ms  86.459 ms  87.362 ms

traceroute-nanog also sends UDP packets by default. But is able to pick up the response much better.

With TCP packets

$ sudo traceroute-nanog -I tcp www.google.com
traceroute to www.google.com (74.125.235.16), 30 hops max, 44 byte packets
 1  192.168.0.1 (192.168.0.1)  1.608 ms  1.057 ms  1.066 ms
 2  10.10.145.1 (10.10.145.1)  3.605 ms  2.929 ms  4.078 ms
 3  203.171.242.33 (203.171.242.33)  27.267 ms  10.904 ms  82.664 ms
 4  203.171.240.17 (203.171.240.17)  3.478 ms  68.433 ms  82.784 ms
 5  203.171.240.1 (203.171.240.1)  75.903 ms  5.006 ms  4.757 ms
 6  121.240.1.38 (121.240.1.38)  46.251 ms  121.001 ms  83.413 ms
 7  209.85.241.52 (209.85.241.52)  74.634 ms  46.323 ms  122.185 ms
 8  209.85.251.95 (209.85.251.95)  83.524 ms  77.467 ms  56.996 ms
 9  66.249.94.74 (66.249.94.74)  120.171 ms  121.323 ms  177.704 ms
10  * * *
11  sin01s04-in-f16.1e100.net (74.125.235.16)  148.922 ms  153.652 ms  89.519 ms

The output looks decent enough. According to wireshark the * nodes did not reply.

Last Updated On : 4th August 2012

Subscribe to get updates delivered to your inbox

1 Comment + Add Comment

  • Interesting results, I wonder if mtr has the same issue when using the ICMP based trace.

Leave a comment