Welcome to the next module where we are going to explore another
extremely common yet powerful tool called traceroute.
Just like we did with ping,
we will examine traceroute in great detail using our Globomantics
and Wired Brain Coffee merge networks for testing.
Here's the lineup.
This module introduces some interesting new message types.
I'll use some fun analogies along with packet walks to introduce them.
Before we start banging on the keyboard,
we need to master how traceroute actually works.
In my experience,
many engineers don't really understand all the
messages and packet flows involved.
It's okay if you're one of them.
That's why you're watching this course.
Once we complete the packet walks,
we will demonstrate traceroute in our network to find the routing
path from Globomantics client to the remote server.
Our trusty Wireshark device will be sniffing for traffic
along the way to reveal the packets to us.
With our packet capture in hand,
we'll dig deep into the packet exchanges between
devices to evaluate what is going on.
Remember those weird unreachable messages that
didn't make sense in the last module?
Yeah, we're going to put some context behind those.
Last,
we will use traceroute to troubleshoot a common
network issue of poor performance.
Since there are some redundant paths in the Globomantics network,
this tool can help show us which way the traffic is flowing,
even if you don't know much about IP routing.
In the previous module,
I spoke for a few minutes about the ICMP type and code constructs.
I promise to revisit the discussion on ICMP unreachables.
To stay on track with this module,
I'll introduce the next to ICMP messages relevant to traceroute.
These ICMP packet types are the TTL exceeded message,
the port unreachable message.
To keep naming conventions simple,
I'm going to lump the TTL exceeded messages into the category of
unreachables since having to verbally caveat its different ICMP type
every time will only bog down the discussion.
And yes, we will be looking at each one of these using Wireshark in this course.
But let's slow down and understand how they work because it's a little
different than ICMP echo‑request and echo‑reply messages.
We will begin by examining the time to live,
or TTL, exceeded message, which is ICMP type 11,
which means time exceeded, and code 0, which means TTL expired in transit.
Unlike ICMP echo‑reply messages,
this message is generated by an intermediate router not
related to the target destination at all.
It's sent whenever an IP packet's TTL counts down to 0 in transit.
It is likely that the administrator who started the traceroute from the
client didn't even know this device was in the path,
and that's the whole point.
These messages help reveal devices in the traffic path.
To find the second hop, a TTL of 2 is used,
which expires at the second hop and generates yet another TTL exceeded message.
You might be wondering how the client running
traceroute interprets this message.
Imagine sending out a bunch of probes and then getting
back multiple ICMP TTL exceeded messages,
as shown above.
How does the initiator device marry up the probes to the
corresponding TTL exceeded messages?
Which one is which?
The answer is simple.
Many ICMP messages, including this one,
can encapsulate the IP header from the original probe
when it is sent back to the client.
Think of it like the postal service.
You mail out two letters to a friend,
and you don't put enough postage on the gray envelope.
The postal service puts a sticker on it that says insufficient postage,
return to sender, and then returns the gray envelope.
The orange envelope with correct postage is correctly delivered,
and no return to sender message is required.
The general idea is that you are not left guessing,
hey, which one of my letters didn't reach my friend?
The answer is clear since the addresses are on the front of the envelope.
You know the gray letter didn't make it.
The ICMP port unreachable message behaves similarly.
It is represented by ICMP type 3, which is a generic destination unreachable,
and code 3, Layer 4 port unreachable.
In this case, pretend you had sufficient postage on the gray envelope, but
your friend rejected your gift because they didn't want it.
It's like when you send your kids socks for Christmas every
year for 10 years and they don't want more socks. They'll
slap a return to sender thanks, but no thanks sticker on it and send it back.
You'll know which gift was returned based on the contents. Let's move past the analogies and look at a more detailed example.