Tracing network connections - tracert command line utility

 

Please comment on this article here.

 

Tracert (Trace Route) is a route-tracing utility that is used to determine the path that an IP datagram takes to reach a destination. The tracert command uses the IP Time-to-Live (TTL) field and ICMP error messages to determine the route from one host to another through a network.

How tracert works

The Tracert diagnostic utility determines the route taken to a destination by sending Internet Control Message Protocol (ICMP) echo packets with varying IP Time-to-Live (TTL) values to the destination. Each router along the path is required to decrement the TTL on a packet by at least 1 before forwarding it. When the TTL on a packet reaches 0, the router should send an "ICMP Time Exceeded" message back to the source computer.

Tracert determines the route by sending the first echo packet with a TTL of 1 and incrementing the TTL by 1 on each subsequent transmission until the target responds or the maximum TTL is reached. The route is determined by examining the "ICMP Time Exceeded" messages sent back by intermediate routers. Some routers silently drop packets with expired TTLs and are invisible to the Tracert utility.

The tracert command prints out an ordered list of the near-side interface of the routers in the path that returned the "ICMP Time Exceeded" message. If the -d option is used, the Tracert utility does not perform a DNS lookup on each IP address.

In the following example, the packet must travel through two routers (10.0.0.1 and 192.168.0.1) to get to host 172.16.0.99. The default gateway of the host is 10.0.0.1 and the IP address of the router on the 192.168.0.0 network is 192.168.0.1.

C:\>tracert 172.16.0.99 -d
Tracing route to 172.16.0.99 over a maximum of 30 hops
1     2 ms     3 ms     2 ms  10.0.0.1
2    75 ms    83 ms    88 ms  192.168.0.1
3    73 ms    79 ms    93 ms  172.16.0.99
Trace complete.

Troubleshooting with tracert

You can use the tracert command to determine where a packet stopped on the network. In the following example, the default gateway has determined that there is not a valid path for the host on 192.168.10.99. There is probably a router configuration problem or the 192.168.10.0 network does not exist (a bad IP address).

C:\>tracert 192.168.10.99

Tracing route to 192.168.10.99 over a maximum of 30 hops

1 10.0.0.1 reports: Destination net unreachable.

Trace complete.

The Tracert utility is useful for troubleshooting large networks where several paths can be taken to arrive at the same point.

Tracert command-line options

The tracert command supports several options, as shown in the following table.

tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name

Option	Description
-d	Specifies that IP addresses are not resolved to host names.
-h maximum_hops	Specifies the number of hops to allow in tracing a route to the host named in target_name.
-j host-list	Specifies the list of router interfaces in the path taken by the Tracert utility packets.
-w timeout	Waits the number of milliseconds specified by timeout for each reply.
target_name	Name or IP address of the target host.

For more information, see To trace a path by using the tracert command

Testing routers by using pathping

The pathping command is a route tracing tool that combines features of the ping and tracert commands with additional information that neither of those tools provides. The pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems. A number of options are available, as shown in the following table.

Option	Name	Function
-n	Hostnames	Does not resolve addresses to host names.
-h	Maximum hops	Maximum number of hops to search for target.
-g	Host-list	Loose source route along host list.
-p	Period	Number of milliseconds to wait between pings.
-q	Num_queries	Number of queries per hop.
-w	Time-out	Waits this many milliseconds for each reply.
-T	Layer 2 tag	Attaches a layer-2 priority tag (for example, for IEEE 802.1p) to the packets and sends it to each of the network devices in the path. This helps in identifying the network devices that do not have layer-2 priority configured properly. The -T switch is used to test for Quality of Service (QoS) connectivity.
-R	RSVP test	Checks to determine whether each router in the path supports the Resource Reservation Protocol (RSVP), which allows the host computer to reserve a certain amount of bandwidth for a data stream. The -R switch is used to test for Quality of Service (QoS) connectivity.

The default number of hops is 30, and the default wait time before a time-out is 3 seconds. The default period is 250 milliseconds, and the default number of queries to each router along the path is 100.

The following is a typical pathping report. The compiled statistics that follow the hop list indicate packet loss at each individual router.

D:\>pathping -n msw

Tracing route to msw [7.54.1.196]
over a maximum of 30 hops:
  0  172.16.87.35
  1  172.16.87.218
  2  192.68.52.1
  3  192.68.80.1
  4  7.54.247.14
  5  7.54.1.196

Computing statistics for 125 seconds...
            Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
  0                                           172.16.87.35
                                0/ 100 =  0%   |
  1   41ms     0/ 100 =  0%     0/ 100 =  0%  172.16.87.218
                               13/ 100 = 13%   |
  2   22ms    16/ 100 = 16%     3/ 100 =  3%  192.68.52.1
                                0/ 100 =  0%   |
  3   24ms    13/ 100 = 13%     0/ 100 =  0%  192.68.80.1
                                0/ 100 =  0%   |
  4   21ms    14/ 100 = 14%     1/ 100 =  1%  10.54.247.14
                                0/ 100 =  0%   |
  5   24ms    13/ 100 = 13%     0/ 100 =  0%  10.54.1.196

Trace complete.

When pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the tracert command. The pathping command then displays a busy message for the next 125 seconds (this time varies by the hop count). During this time, pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results.

The two rightmost columns--This Node/Link Lost/Sent=Pct and Address--contain the most useful information. The link between 172.16.87.218 (hop 1), and 192.68.52.1 (hop 2) is dropping 13 percent of the packets. All other links are working normally. The routers at hops 2 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path.

The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers' CPUs might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.