I admit that this topic is a bit tangential,
but I would be remiss if I didn't at least spend a few minutes discussing it.
Some platforms do not use UDP probes for traceroute, but
instead use ICMP echo‑request messages.
Generally, this implementation is limited to Microsoft Windows devices.
I will quickly recap the packet walk using this method if we pretend that
our Globomantics client is a Windows device. First, the client sends three
ICMP echo‑request messages with a TTL of 1. As expected, the first‑hop
router replies back with three TTL exceeded messages, which encapsulate the
original echo‑request probes. Because each probe has different ICMP sequence
numbers, traceroute can map each TTL exceeded message to the corresponding
echo probe.
This is similar to using UDP port numbers, which is more common
with UNIX and Linux platform implementations.
Next, the client sends three ICMP echo‑request messages with a TTL of 2.
This is the exact same process again,
except the second‑hop router provides the TTL exceeded this time.
Not much new here, so I won't belabor the point.
The last part is interesting.
The ICMP echo‑request actually reached their intended target.
Unlike the rejected UCP probes, which targeted bogus port numbers,
these ICMP echo‑requests are accepted.
They are just ping packets after all, so the target simply
sends echo‑reply messages in return.
This implementation is actually a bit simpler than the UDP paste one from a
purely technical perspective. From an operational perspective,
many networks filter ping traffic across routers and
firewalls for security reasons.
Common attacks, such as the ping of death, a basic but effective
denial‑of‑service attack, can be thwarted this way.
The UDP implementation works around this.
If you aren't sure which ICMP messages to consider permitting
across your network, stay tuned because I've got a whole
module to cover that very topic.
But before we dive into that,
let's recap what we've learned. Most traceroute implementations use UDP
probes with bogus destination ports, which either expire in transit or
target a closed port on the target host.
Windows relies entirely on ICMP.
When UDP probe TTLs expire in transit,
a TTL exceeded unreachable is sent back from the
intermediate router towards the center.
When UDP probes reached their target,
the target replies with port unreachable messages to inform the
client that the traceroute process has completed.
Aside from the technical details, traceroute is useful because it
reveals the routing path through a network.
This can be used to troubleshoot lack of connectivity,
poor connectivity, or suboptimal application performance.
After ping, it's a good second step in your network
troubleshooting process for a wide variety of scenarios.
Next, we explore one more key use case of ICMP messaging to solve
one of networkings most frustrating problems, fragmentation