Traceroute

Overview
Purpose
ICMP Traceroute
UDP Traceroute
TCP Traceroute
Video

The NetScanTools Pro Traceroute tool is an enhanced version of the classic network troubleshooting tool used to show the route packets take to a target device over an IP network. The target device can be on a local area network or across the internet. Our traceroute supports both Windows style ICMP Echo Request and Unix style unused UDP port methods. Plus we have firewall penetrating TCP Traceroute**. All methods depend on returning ICMP packets from intermediate devices along the route. Our multithreaded modes are very fast. An ICMP traceroute to netscantools.com takes 4 seconds including resolution of all IPv4 addresses to hostnames.

Statistics including packet loss, minimum, average and maximum round-trip time are also shown.

There are three different modes of Traceroute:

ICMP Echo Request/Reply Traceroute packets (similar to Windows command line tracert methodology)

UDP packet to unused port/ICMP port unreachable reply (similar to Unix/Linux classic traceroute methodology)

TCP packet to a used or unused port/TCP packet reply (RST, ACK, etc.)

Version 11 Traceroute Slideshow

Important Notes:

Supports IPv4. IPv6 coming soon.

Purpose of this tool:

This tool is designed for the route packets take to a target from your computer. It is a connectivity and protocol latency tool.
Retrieval of AS (autonomous system) numbers from IRR databases. Double click on a hop in a completed trace and NetScanTools Pro will query an IRR server for the AS number.
Shows the Country that is allocated or assigned each IP address appearing in each hop.

ICMP Traceroute

ICMP Traceroute mode uses ICMP echo request packets to trace to a target. The target typically responds with ICMP echo reply packets. As with all traceroute utilities, the echo request packets have an incrementing TTL value that 'expires' at each hop along the way. The intermediate hops reply with an ICMP type 11 time exceeded packet. The time it takes for a packet to get each hop/target and back is called the round trip time.

NetScanTools Pro has two modes of ICMP ping: MS ICMP mode uses an operating system function to send and receive the ping packets while the other mode for ICMP ping uses WinPcap as both the transmission and reception driver. The WinPcap dependent method allows sub-millisecond timing resolution for ping round trip times in contract to the MSICMP Ping method that has a resolution in the 10s of milliseconds. Both modes send packets to each hop in parallel (multithreaded).

The data portion of the payload for ICMP ping may be a simple 'a-z' repeating character string or the contents of any file you choose (binary or ascii).

ICMP packets are sometimes blocked by firewalls either between you and the target or on the target itself, so NetScanTools Pro has two other methods of tracing the route to a target: UDP and TCP.

UDP Traceroute

UDP Ping uses UDP packets to trace to a target. The target typically responds with ICMP port unreachable packets. As with all traceroute utilities, the UDP packets have an incrementing TTL value that 'expires' at each hop along the way. The intermediate hops reply with an ICMP type 11 time exceeded packet. The time it takes for a packet to get the hop/target and back is called the round trip time.

NetScanTools Pro has two modes of UDP traceroute: UDP Variable mode sends UDP packets to a linear set of UDP ports in parallel (multithreaded). The second mode sends the UDP packets to only one UDP port and waits for each responding ICMP packet. Both modes use WinPcap for monitoring responses so you will see sub-millisecond timing resolution.

The data portion of the payload for UDP packet may be a simple 'a-z' repeating character string or the contents of any file you choose (binary or ascii).
UDP source and destination ports are separately user-defined.

TCP Traceroute

TCP Ping uses TCP SYN packets to trace to a target. The target typically responds with either TCP SYN/ACK or RST packets. The time it takes for a packet to get the target and back is the round trip time. TCP traceroute uses WinPcap to send the TCP packets and receive the responding TCP packets. This mode allows you to see sub-millisecond timing resolution for TCP traceroute. You can use this tool to determine the latency for web servers or mail servers or just about any TCP service that is present on the target.

TCP Traceroute uses either SYN or ACK packets to elicit a responding TCP packet from the target. ICMP packets are not used in this mode. The round-trip time of the packet pair is the latency of the TCP connection.
TCP source and destination ports are separately user-defined.
TCP header fields are user defined and may also be randomly selected. These fields are Sequence, Window, and Acknowledgement.
TCP packet options section for MTU is included and the value is user defined.
TCP Ping (WinPcap modes) allow full control over the Differentiated Services CodePoint Bits (DSCP) and the Explicit Congestion Notification bits, ECN-ECT, ECN-CE. You can change these bits to observe the effect on packet delivery through routers.

Traceroute sends TCP packets to a user specified port (web server port 80 is recommended). TCP Traceroute will often work through firewalls protecting the target where the other types of traceroute will not, this is not guaranteed and depends on the target system configuration. Note that our specialized traceroute modes require the use of WinPcap. We install WinPcap as part of the installation package. WinPcap is designed for wired ethernet cards, not modems and it may or may not work with wireless interfaces.

Video

Watch a demonstration of NetScanTools Pro doing a TCP Traceroute to a web server.