Let’s take a look at this in more detail: The IP header now contains different Source and Destination addresses This particular UDP stream contains 1 ICMP packet (113). In the same IP header we also see the TTL (Time to Live) field set as 1: Here is the entire capture from the point of starting the traceroute: PCAP of tracerouteĪ UDP packet (112) is encapsulated and the IP header confirms the source and destination IP addresses as expected: Loose, Strict, Record, Timestamp, Verbose: VIOS1 Gig0/0 to vIOS2 Gig0/0 vIOS1#traceroute So I have setup captures on each routers interface and will set off a traceroute and then talk through the results. Before we go any further, lets check this in the capture and then go from there with the how and why. So if you do a quick Google on how traceroute works, you will more than likely start reading about TTL values and how they change along the way. Let’s stick with the probe count of 1 as it will our lives easier in the packet captures. lets now dive deeper into how exactly traceroute is working. why do we have 3 responses on each hop? This is down to the probe value and can be set using the extended traceroute command as per below: In this example we change the probe count to 1 and sure enough we only see 1 response now on each hop We have a path shown from this source to the destination. VRF info: (vrf in name/id, vrf out name/id) Ok so here we go… lets perform the standard traceroute and get the basic output: vIOS1#traceroute 10.3.0.4 ***This traceroute on Cisco IOS will use UDP for it’s transport.Let’s perform a traceroute from vIOS1 to vIOS4: Everyone is advertising their networks into Area 0, so full end to end reachability is possible. First of all…my own definition of traceroute: “ To identify all Layer 3 network devices in a given path to a destination“Ĥ routers in the lab running OSPF in area 0. This one likes to make an appearance now and then so let’s dive into the lab and get the answer.

Wireshark uses icmp traceroute