The output of the traceroute command generates a list of hops that were successfully reached.  If the data successfully reaches the intended destination, then the output indicates every router that the datagram passes through. This output can be captured and used for future troubleshooting of the internetwork.

Traceroute output will also indicate the specific hop at which the failure is occurring. For each router in the path a line of output is generated on the terminal indicating the IP address of the interface that the data entered. If an asterisk (*) appears, the packet failed. By obtaining the last good hop from the traceroute output and comparing it to a diagram of the internetwork, the problem area can be isolated.

Traceroute also provides information indicating the relative performance of links. The round trip time (RTT) is the time required to send an echo packet and get a response. This is useful for an approximate idea of the delay on the link. These figures are not precise enough to be used for an accurate performance evaluation. However, this output can be captured and used for future performance troubleshooting of the internetwork.

Notice that the device receiving the traceroute also has to know how to send the reply back to the source of the traceroute. In order for the traceroute or ping data to successfully make the round trips between routers, there have to be known routes in both directions. A failed response is not always an indication of a problem because ICMP messages could be rate-limited or filtered at the host site. This is especially true across the Internet.

Traceroute sends out a sequence of User Datagram Protocol (UDP) datagrams from the router to an invalid port address on the remote host. For the first sequence of three datagrams sent, a Time-To-Live (TTL) field value is set to one. The TTL value of 1 causes the datagram to time out at the first router in the path. This router then responds with an ICMP Time Exceeded Message (TEM) indicating that the datagram has expired.

Three more UDP messages are now sent, this time with the TTL value set to 2. This causes the second router to return ICMP TEMs. This process continues until the packets actually reach the other destination.

Since these datagrams are trying to access an invalid port at the destination host, ICMP Port Unreachable Messages are returned instead of the ICMP Time Exceeded Message. This indicates an unreachable port and signals the traceroute program, terminating the process.

Lab Activity Lab Exercise: Troubleshooting using Traceroute This lab is to use the traceroute or tracert command to verify that the network-layer between source, destination and each router along the way is working properly.

Web Links Using the Extended ping and Extended traceroute Commands http://www.cisco.com/en/US/t ech/tk826/tk365/ technologies_tech_ note09186a0080093f22.shtml