GATE IT 2005 | Question: 26

Question

Traceroute reports a possible route that is taken by packets moving from some host $A$ to some other host $B$. Which of the following options represents the technique used by traceroute to identify these hosts:

• A. By progressively querying routers about the next router on the path to $B$ using $\text{ICMP}$ packets, starting with the first router
• B. By requiring each router to append the address to the $\text{ICMP}$ packet as it is forwarded to $B$. The list of all routers en-route to $B$ is returned by $B$ in an $\text{ICMP}$ reply packet
• C. By ensuring that an $\text{ICMP}$ reply packet is returned to $A$ by each router en-route to $B,$ in the ascending order of their hop distance from $A$
• D. By locally computing the shortest path from $A$ to $B$

Comments

@jeets option A is telling how trace route is actually working.

Trace route is application of ICMP querry 

ICMP error message is not a reply message.

Ttl exceed is itself an error message not a reply.

 

 

---

I think there is slight problem in the wording of option A, it should be like ->  By progressively querying routers, ( a comma should be there ) about the next router on the path to B ( that is which router is next on the path to B . If TTL =1 then we get next router as R1 , if TTL = 2 then next router to R1 is R2 . So here next router doesn't mean we are asking a Router R about the next router to it. Here next router means which routers comes in path one by one ) using ICMP packets, starting with the first router

---

NOT in syllabus for 2027 (IP support protocols are removed)

Answer 1

(A) Traceroute works by sending packets with gradually increasing $\text{TTL}$ value, starting with $\text{TTL}$ value of $1$. The first router receives the packet, decrements the $\text{TTL}$ value and drops the packet because it then has $\text{TTL}$ value zero. The router sends an $\text{ICMP}$ Time Exceeded message back to the source. The next set of packets are given a $\text{TTL}$ value of $2,$ so the first router forwards the packets, but the second router drops them and replies with $\text{ICMP}$ Time Exceeded. Proceeding in this way, traceroute uses the returned $\text{ICMP}$ Time Exceeded messages to build a list of routers that packets traverse, until the destination is reached and returns an ICMP Echo Reply message.

Comments

ICMP packets aren't used for querying. More specifically, UDP packet with an unlikely destination port number is used (this is because if a packet survives till destination, destination sends an icmp packet denoting port not active; this is used by traceroute to see that this icmp packet is in fact from destination).

Option C seems to be the closest answer

---

There is no such thing as "querying routers" using ICMP packets. Traceroute simply sends multiple ICMP echo packets with increasing TTLs till it finds a reply instead of an error while recording the errors. Nothing matches. I would like to say C is the answer but, you don't get echo reply packets from routers you get TTL expired errors.

---

NO WRONG!!!

Answer 2

Answer is C)

Traceroute is a little program that can run in any Internet host. When the user specifies a destination hostname, the program sends multiple packets towards that destination. As these packets work their way towards the destinations, they pass through a series of routers. When a router receives one of these packets, it sends a little message back to the source. This message contains the name and address of the router. More specifically, suppose there are N-1 routers between the source and the destination. Then the source will send N packets into the network, with each packet addressed to the ultimate destination. These packets are also marked 1 through N, with the first of the N packets marked 1 and the last of the N packets marked N. When the nth router receives the nth packet marked n, the router destroys the packet and sends a message to the source. And when the destination host receives the Nth packet, the destination destroys it as well but again returns a message back to the source. The source records the time that elapses from when it sends a packet until when it receives the corresponding return message; it also records the name and address of the router (or the destination host) that returns the message. In this manner, the source can reconstruct the route taken by packets flowing from source to destination, and the source can determine the round-trip delays to all the intervening routers. Traceroute actually repeats the experiment just described three times, so the source actually sends 3*N packets to the destination.

The above is taken from Kurose and Ross.

The [RFC 1393] describes traceroute in detail.

ICMP is specified in [RFC 792]. The most typical use of ICMP is for error reporting.ICMP messages have a type and a code field, and also contain the first 8 bytes of the IP packet that caused the IP message to be generated in the first place (so that the sender can determine which packet is sent that caused the error). Selected ICMP messages are shown below:

ICMP type           Code           Description

0                                 0                   echo reply (to ping)

3                                 0                   destination network unreachable

3                                 1                   destination host unreachable

3                                 2                  destination protocol unreachable

3                                 3                  destination port unreachable

3                                 6                   destination network unknown

3                                  7                  destination host unknown

4                                 0                   source quench (congestion control)

8                                 0                    echo request

9                                 0                     router advertisement

10                              0                      router discovery

11                              0                       TTL expired

Traceroute uses ICMP messages. To determine the names and addresses of the routers between source and destination, Traceroute in the source sends a series of ordinary IP datagrams to the destination. The first of these datagrams have a TTL of 1, the second of 2, the third of 3, etc. The source also starts timers for each of the datagrams. When the nth datagram arrives at the nth router, the nth router observers that the TTL of the datagram has just expired. According to the rules of the IP protocol, the router discards the datagram (because there may be a routing loop) and sends an ICMP warning message to the source (type 11 code 0). This warning message includes the name of the router and its IP address. When the ICMP message corresponding to the nth datagram arrives at the source, the source obtains the round-trip time from the timer and the name and IP address from the ICMP message.

Comments

@rahul 

• But when actual message goes ,then there can be multiple paths? 

YES, there can be multiple paths .

see here , Traceroute 

can also report -->  (A , R1 , R2 , R5 , B) (very less chances but still it can report like this )

can also report --> (A , R1 , R2 , R3 , B)  --> in most of the cases you will get this 

can also report --> (A , R1 , R4 , R5 , B)  --> in most of the cases you will get this 

Which path does traceroute  report? 

Ans : In most of the time Traceroute is going to give you correct route (path) but still there is chances that Traceroute will not report you the correct path. for better understanding You can see the result of Traceroute command by typing it many times most of the time you might get different route and some time same route .    :)

for windows :  tracert www.gateoverflow.in

for linux : traceroute www.gateoverflow.in 

Explanation : Even though Traceroute is going to give Router at number of hops but when you put all them (router) together they need not form any path , But the chances are that we are going to send dummy packet immediately (within a fraction of second -> can see in my previous comment image ) therefore basic assumption is that routes will not change so dynamically (i.e. in 1 ms the route might not change ) the entire procedure might take 1 second , so most of the cases we get the perfect route AND Its is not always guaranteed which means you could also expect that there is something wrong is this . (like above image )

Traceroute is mainly used by Sender side to get  to know the route .

FOR EXACT Route go for Record Route which is used by Network Admin & they can find the exact route . They will send only one packet and this one packet will go only through  one route and they will find the exact route  BUT in Traceroute we are sending many packets and they may take different route therefore every time we get a router which is at so and so hops and if you all them put together then they might not even form a path .   

I hope NOW its clear to you .    :) 

---

thanks for you effort:). Got it now

---

MOST WELCOME!!!   :)

Answer 3

I DON'T UNDERSTAND HOW PEOPLE ARE GETTING OPTION A...FROM WHERE?? 

 

Correct Explanation: How Traceroute Works (Option C)

Traceroute identifies each hop on the path to a destination by sending packets with incrementally increased TTL (Time To Live) values:

1. What happens:

   • The source sends packets with TTL = 1, 2, 3, … one after the other.

   • Each router along the path decrements the TTL; if TTL reaches 0, that router drops the packet and sends back an ICMP "Time Exceeded" message.

     • This is how the source learns the identity (IP address) of each intermediate router.

2. Destination reached:

   • When TTL is high enough to reach the destination, it responds—either via ICMP Echo Reply (on Windows) or ICMP Destination Unreachable (UDP probes in Unix).

3. Summary:

   • Each ICMP reply comes in hop order, thanks to increasing TTLs.

   • The source doesn’t “ask for the next hop” directly; it passively receives replies based on how TTL works.

---

Why Option A Is Incorrect

Option A describes an active query approach:

“By progressively querying routers about the next router on the path to B using ICMP packets, starting with the first router.”

This is misleading because:

• Routers don’t provide their routing tables or “next-hop” data on demand.

• Traceroute doesn’t send direct queries like “who is next?” to each router.

• Instead, it relies on TTL expiry to cause routers to respond with ICMP messages—no cooperation is required on the router’s part.

 

SOURCES:

 

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/12778-ping-traceroute.html

https://www.fortinet.com/resources/cyberglossary/traceroutes

https://www.ibm.com/docs/en/aix/7.1.0?topic=t-traceroute-command

https://obkio.com/blog/traceroutes-what-are-they-and-how-do-they-work/

https://networklessons.com/system-management/traceroute

Comments

https://www.youtube.com/watch?v=up3bcBLZS74

Answer 4

According to CISCO:

Source: https://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13730-ext-ping-trace.html

So Ans should be A

traceroute command can be used to discover the paths packets take to a remote destination, as well as where routing breaks down.

The purpose behind the traceroute command is to record the source of each ICMP "time exceeded" message in order to provide a trace of the path the packet took to reach the destination.

The device that executes the traceroute command sends out a sequence of User Datagram Protocol (UDP) datagrams, each with incrementing Time-To-Live (TTL) values, to an invalid port address (Default 33434) at the remote host.

First, three datagrams are sent, each with a TTL field value set to 1. The TTL value of 1 causes the datagram to "timeout" as soon as it hits the first router in the path. This router then responds with an ICMP "time exceeded" message which indicates that the datagram has expired.

Next, three more UDP messages are sent, each with the TTL value set to 2. This causes the second router in the path to the destination to return ICMP "time exceeded" messages.

This process continues until the packets reach the destination and until the system that originates the traceroute receives ICMP "time exceeded" messages from every router in the path to the destination. Since these datagrams try to access an invalid port (Default 33434) at the destination host, the host responds with ICMP "port unreachable" messages that indicate an unreachable port. This event signals the traceroute program to finish.

Answer 5

Option A it describes how traceroute works

Option C it describes the result of trace route i.e icmp error msg is returned also option c says icmp reply is returned is wrong bcz icmp reply and icmp error msg both are different things

Comments

A fellow go classes student I assume?

Answer 6

Answer:
C. By ensuring that an ICMP reply packet is returned to AA by each router en-route to BB, in the ascending order of their hop distance from AA.

Explanation:
Traceroute operates by sending packets (ICMP/UDP) with incrementally increasing TTL (Time-To-Live) values. Each router decrements the TTL, and when it reaches zero, the router discards the packet and sends an ICMP Time Exceeded message (a type of ICMP error reply) back to the source. Starting with TTL=1, the first router responds, then TTL=2 triggers the second router, and so on. This ensures responses are received in ascending hop order, mapping the route to the destination. While the term "reply" might imply an Echo Reply, ICMP error messages like Time Exceeded are still categorized as replies in this context.

Key Clarification:
The confusion arises from the term "reply," but ICMP Time Exceeded messages are indeed replies (error-type ICMP packets) sent by routers. The mechanism described in Option C aligns perfectly with how traceroute works.