What can traceroute show about the path to an IP address?¶
title: "What can traceroute show about the path to an IP address?" status: "complete" source_document: "https://docs.google.com/document/d/10JI31l8aq1aaju85LBvQYGOPvwOrDa3ACRXBx7EBKUQ/edit?usp=drivesdk"
What can traceroute show about the path to an IP address?¶
Traceroute is a diagnostic technique that attempts to identify network systems encountered as traffic moves towards a destination.
It sends packets in a way that encourages routers along the path to return responses. Those responses may reveal the IP addresses of some of the intermediate network hops and the approximate time taken to receive each reply.
The result can help identify networks involved in carrying the traffic, where a route appears to change between providers or whether an address is reached through particular infrastructure. It may also assist in recognising hosting networks, gateways or routing anomalies.
But traceroute doesn't produce a complete map of the internet connection. Routers may refuse to respond, return a different interface address or treat diagnostic traffic differently from ordinary application traffic. Some hops may appear as timeouts even though traffic continues through them successfully.
The forward and return paths may also differ. Responses can follow another route back to the investigator, and load balancing may cause repeated tests to show different hops. The route used by traceroute may not be identical to the route taken by the original event.
Names and apparent locations attached to hops require caution. Router hostnames may contain airport codes or city abbreviations, but those labels can be outdated, administrative or misleading. Geolocation services may place network infrastructure at a provider office, data centre or default map position rather than its physical location.
Traceroute is also a present-time observation. Internet routing changes, so a route measured today may not reconstruct the path used during an event days, months or years earlier.
A traceroute can show responding network hops encountered during a particular test. It can provide useful routing and infrastructure intelligence, but it doesn't establish a precise physical journey or identify the original device, user or person responsible.