Traceroute explanation
Hey folks, i see a strange traceroute there Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts : 1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746 __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
Hi, nothing surprises me from Tinet any more... at one time all my traffic from Europe was routed through some Hong Kong router of theirs... but, enough jokes... this could be the path the packets are traversing through, nothing wrong with it, as long as everything is working fine... ie. packet gets delivered to destination, and reply comes back, within reasonable time frame... not like traveling across the globe... :) Regards, On Wed, Dec 7, 2011 at 20:12, Meftah Tayeb <tayeb.meftah@gmail.com> wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
-- ricky
yeah, i'm ok with you for that but the hell surprise is that i am going to telecom italia that i realy don't like anymore, Level3 aguin, then tinet, then level3, then tinet ? that strange. ----- Original Message ----- From: "Sasa Ristic" <ristic.sasa@gmail.com> To: <nanog@nanog.org> Sent: Thursday, December 08, 2011 10:58 PM Subject: Re: Traceroute explanation Hi, nothing surprises me from Tinet any more... at one time all my traffic from Europe was routed through some Hong Kong router of theirs... but, enough jokes... this could be the path the packets are traversing through, nothing wrong with it, as long as everything is working fine... ie. packet gets delivered to destination, and reply comes back, within reasonable time frame... not like traveling across the globe... :) Regards, On Wed, Dec 7, 2011 at 20:12, Meftah Tayeb <tayeb.meftah@gmail.com> wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
-- ricky __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
This is just a guess, but I'll bet the route changed while you were measuring it. Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was 172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is 172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on The effect would be to get a result like this. Next time you see something like this, suggestion: repeat the traceroute and see what you get. On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
big thank for that but, i am testing that for one day :) ----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation This is just a guess, but I'll bet the route changed while you were measuring it. Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was 172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is 172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on The effect would be to get a result like this. Next time you see something like this, suggestion: repeat the traceroute and see what you get. On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
big thank for that but, i am testing that for one day :)
Can you do an AStraceroute or manually translate those addresses into AS#s? That is, might level3 and tinet be using multiple AS#s, in which case this isn't unreasonable?
----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
please tel me how to ? i don't know astraceroute:) ----- Original Message ----- From: "Steven Bellovin" <smb@cs.columbia.edu> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:33 PM Subject: Re: Traceroute explanation On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
big thank for that but, i am testing that for one day :)
Can you do an AStraceroute or manually translate those addresses into AS#s? That is, might level3 and tinet be using multiple AS#s, in which case this isn't unreasonable?
----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
I don't know what platform you're using, but there's a separate command. See http://www.shrubbery.net/astraceroute/ . If you're using Linux, there's probably a package in your favorite repository. There seem to be other variants floating around the net. If you're using Windows, I have no idea what's available. On Dec 7, 2011, at 2:56 16PM, Meftah Tayeb wrote:
please tel me how to ? i don't know astraceroute:)
----- Original Message ----- From: "Steven Bellovin" <smb@cs.columbia.edu> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:33 PM Subject: Re: Traceroute explanation
On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
big thank for that but, i am testing that for one day :)
Can you do an AStraceroute or manually translate those addresses into AS#s? That is, might level3 and tinet be using multiple AS#s, in which case this isn't unreasonable?
----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
Hai! Check with lft or mtr ... Thanks, Raymond Dijkxhoorn, Prolocation Op 7 dec. 2011 om 20:56 heeft "Meftah Tayeb" <tayeb.meftah@gmail.com> het volgende geschreven:
please tel me how to ? i don't know astraceroute:)
----- Original Message ----- From: "Steven Bellovin" <smb@cs.columbia.edu> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:33 PM Subject: Re: Traceroute explanation
On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
big thank for that but, i am testing that for one day :)
Can you do an AStraceroute or manually translate those addresses into AS#s? That is, might level3 and tinet be using multiple AS#s, in which case this isn't unreasonable?
----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
Using LFT: root@debian:~# lft 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets 1 172.28.1.1 (172.28.1.1) 0.798 ms 0.711 ms 2 10.16.0.2 (10.16.0.2) 0.414 ms 0.331 ms 3 41.200.16.1 (41.200.16.1) 11.400 ms 11.474 ms 4 172.17.2.25 (172.17.2.25) 10.184 ms 11.322 ms 5 213.140.58.10 (213.140.58.10) 11.264 ms 10.623 ms 6 212.73.253.65 (212.73.253.65) 30.330 ms 32.391 ms 7 ae-4-5.bar1.Marseille1.Level3.net (4.69.151.9) 32.177 ms 32.219 ms 8 ae-7-7.ebr1.Paris1.Level3.net (4.69.143.238) 42.160 ms 42.318 ms root@debian:~# lft www.rri.ro traceroute to www.rri.ro (193.231.72.52), 30 hops max, 60 byte packets 1 172.28.1.1 (172.28.1.1) 0.819 ms 0.737 ms 2 10.16.0.2 (10.16.0.2) 0.402 ms 0.335 ms 3 41.200.16.1 (41.200.16.1) 10.592 ms 10.209 ms 4 172.17.2.25 (172.17.2.25) 10.146 ms 10.559 ms 5 213.140.58.10 (213.140.58.10) 11.258 ms 10.369 ms 6 pos14-0.palermo9.pal.seabone.net (195.22.197.125) 30.817 ms 31.439 ms 7 ae-5-6.bar2.Marseille1.Level3.net (4.69.151.13) 33.968 ms 31.395 ms 8 ge-0-0-0.mil19.ip4.tinet.net (213.200.68.145) 57.178 ms xe-1-1-0.mil10.ip4. tinet.net (213.200.68.61) 57.749 ms 9 ae-1-12.bar1.Budapest1.Level3.net (4.69.141.249) 61.835 ms 62.317 ms 10 euroweb-gw.ip4.tinet.net (77.67.66.154) 61.361 ms 60.292 ms 11 v15-core1.stsisp.ro (193.151.28.1) 163.662 ms 144.245 ms 12 inet-crli1.qrli1.buh.ew.ro (81.24.28.226) 91.309 ms 89.880 ms 13 193.231.72.10 (193.231.72.10) 80.790 ms 79.354 ms 14 ip4-89-238-225-90.euroweb.ro (89.238.225.90) 91.067 ms 90.906 ms 15 webrri.rri.ro.72.231.193.in-addr.arpa (193.231.72.52) 79.196 ms 79.389 ms root@debian:~# ----- Original Message ----- From: "Raymond Dijkxhoorn" <raymond@prolocation.net> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: "Steven Bellovin" <smb@cs.columbia.edu>; <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:40 PM Subject: Re: Traceroute explanation Hai! Check with lft or mtr ... Thanks, Raymond Dijkxhoorn, Prolocation Op 7 dec. 2011 om 20:56 heeft "Meftah Tayeb" <tayeb.meftah@gmail.com> het volgende geschreven:
please tel me how to ? i don't know astraceroute:)
----- Original Message ----- From: "Steven Bellovin" <smb@cs.columbia.edu> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: "Fred Baker" <fred@cisco.com>; <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:33 PM Subject: Re: Traceroute explanation
On Dec 7, 2011, at 2:51 08PM, Meftah Tayeb wrote:
big thank for that but, i am testing that for one day :)
Can you do an AStraceroute or manually translate those addresses into AS#s? That is, might level3 and tinet be using multiple AS#s, in which case this isn't unreasonable?
----- Original Message ----- From: "Fred Baker" <fred@cisco.com> To: "Meftah Tayeb" <tayeb.meftah@gmail.com> Cc: <nanog@nanog.org> Sent: Thursday, December 08, 2011 11:23 PM Subject: Re: Traceroute explanation
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
Hi!
Using LFT: root@debian:~# lft 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets 1 172.28.1.1 (172.28.1.1) 0.798 ms 0.711 ms 2 10.16.0.2 (10.16.0.2) 0.414 ms 0.331 ms 3 41.200.16.1 (41.200.16.1) 11.400 ms 11.474 ms 4 172.17.2.25 (172.17.2.25) 10.184 ms 11.322 ms 5 213.140.58.10 (213.140.58.10) 11.264 ms 10.623 ms 6 212.73.253.65 (212.73.253.65) 30.330 ms 32.391 ms 7 ae-4-5.bar1.Marseille1.Level3.net (4.69.151.9) 32.177 ms 32.219 ms 8 ae-7-7.ebr1.Paris1.Level3.net (4.69.143.238) 42.160 ms 42.318 ms
root@debian:~# lft www.rri.ro traceroute to www.rri.ro (193.231.72.52), 30 hops max, 60 byte packets 1 172.28.1.1 (172.28.1.1) 0.819 ms 0.737 ms 2 10.16.0.2 (10.16.0.2) 0.402 ms 0.335 ms 3 41.200.16.1 (41.200.16.1) 10.592 ms 10.209 ms 4 172.17.2.25 (172.17.2.25) 10.146 ms 10.559 ms 5 213.140.58.10 (213.140.58.10) 11.258 ms 10.369 ms 6 pos14-0.palermo9.pal.seabone.net (195.22.197.125) 30.817 ms 31.439 ms 7 ae-5-6.bar2.Marseille1.Level3.net (4.69.151.13) 33.968 ms 31.395 ms 8 ge-0-0-0.mil19.ip4.tinet.net (213.200.68.145) 57.178 ms xe-1-1-0.mil10.ip4. tinet.net (213.200.68.61) 57.749 ms 9 ae-1-12.bar1.Budapest1.Level3.net (4.69.141.249) 61.835 ms 62.317 ms 10 euroweb-gw.ip4.tinet.net (77.67.66.154) 61.361 ms 60.292 ms 11 v15-core1.stsisp.ro (193.151.28.1) 163.662 ms 144.245 ms 12 inet-crli1.qrli1.buh.ew.ro (81.24.28.226) 91.309 ms 89.880 ms 13 193.231.72.10 (193.231.72.10) 80.790 ms 79.354 ms 14 ip4-89-238-225-90.euroweb.ro (89.238.225.90) 91.067 ms 90.906 ms 15 webrri.rri.ro.72.231.193.in-addr.arpa (193.231.72.52) 79.196 ms 79.389 ms root@debian:~#
lft -A snows ASN also. Example: [root@lft ~]# lft -A www.rri.ro -d 80 Tracing .....................T TTL LFT trace to webrri.rri.ro.72.231.193.in-addr.arpa (193.231.72.52):80/tcp 1 [34108] vrrp-253.bbd.prolocation.net (95.128.88.253) 0.3/0.3ms 2 [41887] breedband-delft-rc02-gige-1.prolocation.net (94.228.128.57) 11.8/1.4ms 3 [12871] gigabone10-3.prolocation.net (213.197.27.165) 1.3/1.4ms 4 [1200] amx1.fra.ew.ro (195.69.144.121) 59.5/31.5ms 5 [6663] inet-qrli1.crli1.buh.ew.ro (81.24.28.225) 38.1/38.1ms 6 [6663] inet-crli1.qrli1.buh.ew.ro (81.24.28.226) 37.4/37.5ms 7 [6663] qrli11.drli1.buh.ew.ro (81.24.28.242) 37.9/37.9ms 8 [6663] ip4-89-238-225-90.euroweb.ro (89.238.225.90) 37.7/37.7ms 9 [34808] 193.231.72.10 37.9/37.9ms 10 [34808] [target open] webrri.rri.ro.72.231.193.in-addr.arpa (193.231.72.52):80 37.8/38.0ms Bye, Raymond.
Another explanation could be load balancing. As Fred mentioned, traceroute sends out different packets for different hops on the path and since these packets have different headers, load balancers on the path may hash packets with different TTL values on to different paths. Check out http://www.paris-traceroute.net/ for more information. --Harsha On Dec 8, 2011, at 1:23 PM, Fred Baker wrote:
This is just a guess, but I'll bet the route changed while you were measuring it.
Traceroute sends a request, awaits a response, sends a request, ... Suppose that the route was
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> 4.69.151.13 -> 213.200.68.61 -> somewhere else
and after the test got that far, two systems got inserted into the path before level3, resulting in the route entering level3 at a different point, 4.69.141.249. What you now have is
172.28.0.1 -> 10.16.0.2 -> 41.200.16.1 -> 172.17.2.25 -> 213.140.58.10 -> 195.22.195.125 -> unknown -> unknown -> 4.69.141.249 -> 77.67.66.154 -> and so on
The effect would be to get a result like this.
Next time you see something like this, suggestion: repeat the traceroute and see what you get.
On Dec 7, 2011, at 12:12 PM, Meftah Tayeb wrote:
Hey folks, i see a strange traceroute there
Détermination de l'itinéraire vers www.rri.ro [193.231.72.52] avec un maximum de 30 sauts :
1 2 ms 1 ms 1 ms 172.28.0.1 2 1 ms 1 ms 1 ms localhost [10.16.0.2] 3 10 ms 10 ms 13 ms 41.200.16.1 4 11 ms 10 ms 11 ms 172.17.2.25 5 21 ms 21 ms 21 ms 213.140.58.10 6 34 ms 31 ms 55 ms pos14-0.palermo9.pal.seabone.net [195.22.197.125 ] 7 34 ms 33 ms 35 ms ae-5-6.bar2.marseille1.level3.net [4.69.151.13] 8 106 ms 68 ms 67 ms xe-1-1-0.mil10.ip4.tinet.net [213.200.68.61] 9 74 ms 73 ms 74 ms ae-1-12.bar1.budapest1.level3.net [4.69.141.249] 10 63 ms 63 ms 79 ms euroweb-gw.ip4.tinet.net [77.67.66.154] 11 85 ms 84 ms 84 ms v15-core1.stsisp.ro [193.151.28.1] 12 100 ms 100 ms 102 ms inet-crli1.qrli1.buh.ew.ro [81.24.28.226] 13 81 ms 81 ms 81 ms 193.231.72.10 14 92 ms 92 ms 93 ms ip4-89-238-225-90.euroweb.ro [89.238.225.90] 15 89 ms 89 ms 89 ms webrri.rri.ro.72.231.193.in-addr.arpa [193.231.7 2.52] Itinéraire déterminé. C:\Documents and Settings\TAYEB> Seabone, then level3, then Tinet, then level3, then tinet ? if is that a routing stufs that i don't know, please let me know :) i never saw that befaure
Meftah Tayeb IT Consulting http://www.tmvoip.com/ phone: +21321656139 Mobile: +213660347746
__________ Information from ESET NOD32 Antivirus, version of virus signature database 6695 (20111208) __________
The message was checked by ESET NOD32 Antivirus.
participants (6)
-
Fred Baker -
Harsha V. Madhyastha -
Meftah Tayeb -
Raymond Dijkxhoorn -
Sasa Ristic -
Steven Bellovin