Our Globomantics client kicks off a traceroute towards 10.2.5.5, which
is the remote Wired Brain Coffee server. The traceroute probes on most
non‑Windows operating systems are UDP based,
not ICMP echo‑requests.
Why is that? The generally accepted, but non‑scientific
answer is that oftentimes ICMP ping traffic is blocked by
routers and firewalls along the way.
This means that our tried‑and‑true ping tool would not work.
We will touch on this more later in the security section, so don't
sweat it for now. Just know that UDP probes are most often used.
On most operating systems, traceroute will send three probes at a
given time‑to‑live value.
Each probe will also use an incrementing import number. At
the first hop, the probes will all have TTL of 1 and use
ports 33434 through 33436.
When these packets reach R1, the TTL immediately expires.
R1 notifies the sender using a TTL exceeded message we discussed previously.
When the host receives these unreachables, it displays the source IP address
of the originator of the unreachable, which is 10.1.4.1 in this case. This
means that 10.1.4.1 is the first hop in the path.
We are literally tracing the route this way. We'll move
more rapidly through the second hop.
The client now sends three more probes, this time using the next
three ports of 33437 to 33439 and with a TTL of 2. This traffic
reaches R2, and TTL runs to 0, as expected.
R2 sends TTL exceeded messages back to the original client to
notify them that their packet expired in transit.
The client knows that the second hop in the path is 10.1.2.2.
So far, so good.
The third and final hop of the short path is slightly different.
The client now sends three more probes, this time using the next
three ports and with a TTL of 3. Traffic reaches the final
destination this time, so TTL did not expire.
We had sufficient postage, as it were.
But how does the remote server signal to the client that the path has ended?
This is the magic of the UDP probe.
Since bogus destination ports were used,
the target host will not be listening on those ports and
thus signal back to the sender, hey,
I'm not processing data on those ports using a port unreachable message.
The client traceroute process terminates and records 10.2.5.5
as the final hop, which was the target.
This unreachable message is analogous to the
Christmas socks example I gave earlier. Next, we'll explore this on the live network.