0

How could I show remaining time to live counters in mtr or traceroute results?

$ mtr -r -w -c 10 91.250.127.30
Start: Mon May 15 12:20:44 2017
HOST: <snip>                           Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- <snip---->                        0.0%    10   22.9  19.9   0.3  22.9   6.8
  2.|-- <snip---snip>                     0.0%    10   24.9  22.8  21.6  27.7   1.9
  3.|-- 217.237.154.226                   0.0%    10   23.9  23.9  21.6  25.4   1.2
  4.|-- 217.239.53.234                    0.0%    10   39.3  38.4  34.9  41.8   2.1
  5.|-- 80.157.207.130                    0.0%    10   40.5  45.8  40.4  79.2  11.8
  6.|-- ae5.cr-nashira.cgn4.core.heg.com  0.0%    10   34.9  38.3  34.0  73.0  12.2
  7.|-- ae4.dr-master.cgn4.mass.systems   0.0%    10   35.5  37.7  34.1  66.6  10.1

Can I determine at which hop TTL gets decreased the most? Is there a way to show TTL as output field?

Might nmap offer reporting TTLs?

Edit: @ilkkachu mentioned --back for debian traceroute, that helped a lot.

2

The TTL decreases by one on every hop, or every second. The latter is probably rare enough unless you have some really slow link or really big buffers. Also, what traceroute does is send packets with increasing TTL, so the decrease is shown implicitly in the output so if the route had some part where the TTL would decrease by more than one, or a router would not send the ICMP error, it would show up as an empty line.

# traceroute -I 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  somerouter (...)  1.018 ms  1.118 ms  1.365 ms
 2  * * *
 3  otherrouter (...)  9.436 ms  9.464 ms  9.466 ms
 4  se-tug.nordu.net (109.105.102.102)  15.814 ms  15.821 ms  15.823 ms
 5  netnod-ix-ge-a-sth.google.com (194.68.123.115)  16.200 ms  16.205 ms  16.244 ms
 6  216.239.40.27 (216.239.40.27)  16.087 ms  16.038 ms  16.057 ms
 7  209.85.242.47 (209.85.242.47)  16.682 ms  19.965 ms  20.142 ms
 8  google-public-dns-a.google.com (8.8.8.8)  16.386 ms  16.306 ms  16.306 ms

Here, the router at hop #2 didn't answer, so traceroute got replies for packets with TTL 1 and TTL 3, but not for the one with TTL 2.

  • how comes that sudo traceroute -I 46.252.29.21 shows 62.115.120.3 in step 6 and 213.155.134.87 as 7th hop, but TTL dropping from 250 to 58 when pinging them directly without showing stars in traceroute? – sebastianwagner May 15 '17 at 11:04
  • 2
    @sebastianwagner, ah, the TTL on the reply packet depends on what the remote end sets it to when replying, and the number of hops on the return route. So you might get TTLs of 127, then 62 then 125 on the first three return packets. Debian's traceroute has the --back option that can show a guess on the number of hops on the return route (it assumes the reply packet is sent with a TTL of 64, 128, or 255) – ilkkachu May 15 '17 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.