Skip to content
Register

Reading traceroutes without crying

Networking by nerdbann 5 replies 196 views
nerdbann

Member OP

DNS Propagator

#1

Asymmetric routing is the #1 reason people panic at traceroutes. Your return path != forward path. Those asterisks? Usually ICMP rate limits, not packet loss. Modern routers deprioritize ICMP to the control plane.

Key points:

  • Single hop timing out means nothing if later hops reply
  • MPLS tunnels show as single hops or hidden entirely depending on TTL propagation
  • RFC 4884 extended ICMP can break path MTU discovery on some gear

Check your resolver first if DNS names look wrong. dig +trace is your friend. TTL matters for which path you actually hit. I use https://bgp.tools for quick AS path lookups.

I will trace routes for strangers if you post IPs. No geo stuff, just routing.

marcus_qc

Member

#2

My €3 Hetzner vps traceroute to 1.1.1.1 averages 4.2ms last hop and my friends $10 CloudCone is 6.8ms so clearly the cheaper one wins and all this asymmetric routing talk is just excuses for bad network engineering real performance is what matters not your theoretical mpls whatever

42U and still growing
tallinnying

Member

Night Shift

#3

Gg nice guide noob but u forgot the part where mpls hops show up as ??? And u think ur box is pwned when its just some isp hiding their core yikes happens to me all the time on my game boxes traceroute looks dead but traffic flows fine gg

builds at 3AM, sleeps at noon
sara

Member

#4

As a small business owner this is very helpful for me because my customers depend on my site being reachable and I have been chasing asterisks thinking it was my host's problem when maybe it is just normal. I will save this thread. 'Sara's Crafts'

tamuma

Member

#5

Mpls null labels are invisible hops

salavi

Member

Threat Modeler

#6

Assume compromise any exposed traceroute reveals your upstream topology and we should threat model our blast radius accordingly the attack surface includes every hop that responds to icmp and zero trust means zero trust even at layer three I disable icmp on all edge machines

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft