traceroute measurement with abnormally small RTT
Dear list, I recently found a ‘weird’ traceroute measurement record in the sense that: with paris id set, it has different IP addresses for a given hop; after it reached the destination, it tried one more hop; the final hop reported abnormally small RTT. I’d appreciate your views on how this happened. Here is how to identify the measurement in question: (the concerned record is as well provided at the end the mail) from ripe.atlas.cousteau import AtlasResultsRequest filters = dict(msm_id=5010, probe_ids=[10460], start=1482177890, stop=1482177900) _, results = AtlasResultsRequest(**filters).create() It’s a IPv4 traceroute measurement toward DNS b root, 192.228.79.201. What you’ll see is: starting from hop 14, the 3 measurements for the same hop come from different IP address: hop 14: 184.105.80.202, 72.52.92.122 hop 15: 72.52.92.122, 216.218.223.28 hop 16: 216.218.223.28, 130.152.181.189 hop 17: 130.152.181.189, 206.117.5.22 hop 18: 206.117.5.22, 192.228.79.201 hop 19: 192.228.79.201 My first doubt is with Paris traceroute is it still possible that response IP can change due to LB mechanism on the returning path? At hop 18, the traceroute actually already reached the destination, but it continued to perform the hop 19, why? At hop 19, there is one measurement from 192.228.79.201 reporting abnormally small RTT of 0.449ms. How come? Can that happen to other measurements as well, under what circumstances? The above listed neighbouring hops always share one IP address, which makes it seem like a data formatting issue. Is there a known bug? Thanks in advance for your attention. Best regards, wenqin Here below the measurement in question: ==== [ { "lts":-1, "size":40, "from":"176.227.133.141", "dst_name":"192.228.79.201", "fw":4740, "proto":"UDP", "af":4, "msm_name":"Traceroute", "prb_id":10460, "result":[ { "result":[ { "rtt":0.533, "ttl":255, "from":"192.168.1.1", "size":28 }, { "rtt":0.418, "ttl":255, "from":"192.168.1.1", "size":28 }, { "rtt":0.405, "ttl":255, "from":"192.168.1.1", "size":28 } ], "hop":1 }, { "result":[ { "x":"*" }, { "x":"*" }, { "x":"*" } ], "hop":2 }, { "result":[ { "rtt":677.27, "ttl":253, "from":"10.130.162.13", "size":28 }, { "rtt":660.216, "ttl":253, "from":"10.130.162.13", "size":28 }, { "rtt":709.112, "ttl":253, "from":"10.130.162.13", "size":28 } ], "hop":3 }, { "result":[ { "rtt":666.445, "ttl":252, "from":"10.130.162.250", "size":28 }, { "rtt":995.219, "ttl":252, "from":"10.130.162.250", "size":28 }, { "rtt":668.192, "ttl":252, "from":"10.130.162.250", "size":28 } ], "hop":4 }, { "result":[ { "rtt":681.02, "ttl":250, "from":"10.130.162.82", "size":28 }, { "rtt":652.502, "ttl":250, "from":"10.130.162.82", "size":28 }, { "rtt":673.857, "ttl":250, "from":"10.130.162.82", "size":28 } ], "hop":5 }, { "result":[ { "rtt":685.088, "ttl":250, "from":"88.202.127.129", "size":28 }, { "rtt":665.164, "ttl":250, "from":"88.202.127.129", "size":28 }, { "rtt":657.344, "ttl":250, "from":"88.202.127.129", "size":28 } ], "hop":6 }, { "result":[ { "rtt":669.097, "ttl":249, "from":"88.202.127.121", "size":28 }, { "rtt":743.974, "ttl":249, "from":"88.202.127.121", "size":28 }, { "rtt":637.311, "ttl":249, "from":"88.202.127.121", "size":28 } ], "hop":7 }, { "result":[ { "ttl":243, "rtt":692.425, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":439171 } ], "class":1 } ] }, "from":"88.202.127.6", "size":140 }, { "ttl":243, "rtt":659.768, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":439171 } ], "class":1 } ] }, "from":"88.202.127.6", "size":140 }, { "ttl":243, "rtt":698.084, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":439171 } ], "class":1 } ] }, "from":"88.202.127.6", "size":140 } ], "hop":8 }, { "result":[ { "ttl":247, "rtt":684.096, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":311104 } ], "class":1 } ] }, "from":"10.130.2.42", "size":140 }, { "ttl":247, "rtt":685.871, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":311104 } ], "class":1 } ] }, "from":"10.130.2.42", "size":140 }, { "ttl":247, "rtt":736.12, "icmpext":{ "rfc4884":0, "version":2, "obj":[ { "type":1, "mpls":[ { "s":1, "ttl":1, "exp":0, "label":311104 } ], "class":1 } ] }, "from":"10.130.2.42", "size":140 } ], "hop":9 }, { "result":[ { "rtt":675.198, "ttl":246, "from":"10.130.1.201", "size":28 }, { "rtt":671.127, "ttl":246, "from":"10.130.1.201", "size":28 }, { "rtt":683.236, "ttl":246, "from":"10.130.1.201", "size":28 } ], "hop":10 }, { "result":[ { "rtt":736.688, "ttl":54, "from":"37.49.236.10", "size":28 }, { "rtt":697.844, "ttl":54, "from":"37.49.236.10", "size":28 }, { "rtt":818.184, "ttl":54, "from":"37.49.236.10", "size":28 } ], "hop":11 }, { "result":[ { "rtt":992.33, "ttl":53, "from":"184.105.213.173", "size":28 }, { "rtt":920.759, "ttl":53, "from":"184.105.213.173", "size":28 }, { "rtt":966.019, "ttl":53, "from":"184.105.213.173", "size":28 } ], "hop":12 }, { "result":[ { "x":"*" }, { "rtt":428.86, "ttl":52, "from":"184.105.80.202", "size":28 }, { "rtt":372.607, "ttl":52, "from":"184.105.80.202", "size":28 } ], "hop":13 }, { "result":[ { "rtt":448.726, "ttl":52, "from":"184.105.80.202", "size":28 }, { "rtt":427.897, "ttl":51, "from":"72.52.92.122", "size":28 }, { "rtt":550.12, "ttl":51, "from":"72.52.92.122", "size":28 } ], "hop":14 }, { "result":[ { "rtt":422.308, "ttl":51, "from":"72.52.92.122", "size":28 }, { "rtt":447.841, "ttl":241, "from":"216.218.223.28", "size":68 }, { "rtt":339.084, "ttl":241, "from":"216.218.223.28", "size":68 } ], "hop":15 }, { "result":[ { "rtt":470.177, "ttl":241, "from":"216.218.223.28", "size":68 }, { "rtt":338.323, "ttl":241, "from":"130.152.181.189", "size":68 }, { "rtt":482.44, "ttl":241, "from":"130.152.181.189", "size":68 } ], "hop":16 }, { "result":[ { "rtt":359.104, "ttl":241, "from":"130.152.181.189", "size":68 }, { "rtt":630.604, "ttl":48, "from":"206.117.5.22", "size":68 }, { "rtt":195.704, "ttl":48, "from":"206.117.5.22", "size":68 } ], "hop":17 }, { "result":[ { "rtt":759.236, "ttl":48, "from":"206.117.5.22", "size":68 }, { "rtt":369.954, "ttl":48, "from":"192.228.79.201", "size":68 }, { "rtt":431.369, "ttl":48, "from":"192.228.79.201", "size":68 } ], "hop":18 }, { "result":[ { "rtt":397.795, "ttl":48, "from":"192.228.79.201", "size":68 }, { "x":"*" }, { "ttl":48, "rtt":0.449, "ittl":2, "from":"192.228.79.201", "size":68 } ], "hop":19 } ], "timestamp":1482177892, "src_addr":"192.168.1.115", "paris_id":15, "endtime":1482177928, "type":"traceroute", "dst_addr":"192.228.79.201", "msm_id":5010 } ]
Hi, On 2017/01/18 18:01 , Wenqin SHAO wrote:
It’s a IPv4 traceroute measurement toward DNS b root, 192.228.79.201. What you’ll see is: starting from hop 14, the 3 measurements for the same hop come from different IP address:
hop 14: 184.105.80.202, 72.52.92.122 hop 15: 72.52.92.122, 216.218.223.28 hop 16: 216.218.223.28, 130.152.181.189 hop 17: 130.152.181.189, 206.117.5.22 hop 18: 206.117.5.22, 192.228.79.201 hop 19: 192.228.79.201
My first doubt is with Paris traceroute is it still possible that response IP can change due to LB mechanism on the returning path?
Obviously, middle boxes can do anything including changing IP addresses in packets. However, normally you see one the addresses of the router that generated the error ICMP there and the actual return path only affects rtt and ttl.
At hop 18, the traceroute actually already reached the destination, but it continued to perform the hop 19, why?
Traceroute continues if a hop generates a TTL exceeded. For a UDP traceroute the expected value is a UDP port unreachable. Sometimes a middle box in front of the destination sends a TTL exceed when you expect the target to handle the packet.
At hop 19, there is one measurement from 192.228.79.201 reporting abnormally small RTT of 0.449ms. How come? Can that happen to other measurements as well, under what circumstances?
The above listed neighbouring hops always share one IP address, which makes it seem like a data formatting issue. Is there a known bug?
There is something really weird going on here. I have no idea what is causing this. Philip
participants (2)
-
Philip Homburg
-
Wenqin SHAO