We've just finished learning about the UDP probes used
by many traceroute implementations.
One thing that all traceroute implementations have in common is the
TTL exceeded message. Before we dig into the guts of the packet, look
at the source and destination IP address. The destination should
always be the traceroute client.
Remember that this is a return to sender style of packet.
The source address will be the IP address of the intermediate
device that sent the unreachable, typically using the egress
interface back towards the client.
In this case, we see 10.1.4.1 used, which is R1's LAN
interface IP address back towards the client.
If we expand the ICMP header of this packet,
we can see the ICMP type of 11, which identifies this packet as
some kind of time exceeded message. Code 0 specifically
identifies this packet as a TTL exceeded packet. Towards the
bottom, we see something interesting.
The original UDP probe that triggered the creation of this TTL
exceeded packet is encapsulated within the ICMP TTL exceeded
packet on its way back towards the sender.
I mentioned this a few times in previous videos, and now we've finally
proven it with a demonstration and packet capture. Each one of the
other TTL exceeded messages in this packet capture encapsulates its
corresponding UDP probe as well.
When the client receives the TTL exceeded message,
it looks inside and marries up the message with the traceroute probe.
It then measures the transit time in milliseconds, similar to ICMP ping.
This is how traceroute tracks which probes were properly processed
and which ones were dropped or lost in the network.
If you don't believe me, look at the encapsulated packet's checksum.
It's the same as the UDP probe seen on the previous slide.
In the next video,
we will move to the end of the traceroute path and
look at the port unreachable message. Stay tuned.