Comments on: Linux traceroute vs Windows tracert

By: Ben Chapman

Ben Chapman — Wed, 29 Jul 2009 15:46:30 +0000

A belated thank-you for this! Very helpful and explains why a network engineer using Windows and I (using Linux) were seeing different things on our network.

By: DrAtomic

DrAtomic — Wed, 14 Jan 2009 13:24:00 +0000

I think all you are trying to say Bogd is that the windows implementation uses type 8 instead of the dedicted traceroute types (30 etc).

The original blog is correct in the sense that windows uses icmp and linux udp.

On linux you can force traceroute to use ICMP over UDP with traceroute -P ICMP ipnr, note that the linux ICMP trace also uses type 8.

By: Bogd

Bogd — Mon, 05 Jan 2009 16:10:00 +0000

I seem to keep coming back to this page from time to time :)

This time, an answer to what you said in the post:
I googled to find out why Linux traceroute uses UDP by default but I couldn't find any definitive reasons.

The reason is RFC792 (ICMP), which says:
To avoid the infinite regress of messages about messages etc., no ICMP messages are sent about ICMP messages

This is the reason why Unix (and Linux, and Cisco, and other implementations) use UDP. Technically speaking, it is the Windows implementation that is breaking the RFC, not the other way around :)

Speaking of which - your article also says "According to RFC1393, traceroute implementations are supposed to use the ICMP protocol.". While true in theory, that RFC refers to the use of the traceroute ICMP message - which has never been implemented on a large scale (see my previous message).

By: glenn

glenn — Wed, 13 Aug 2008 03:27:00 +0000

I know this is old now, but it was the first useful google hit I got when trying to understand why UDP was used.

I eventually came upon this, which seems to give a nice answer: http://www.inetdaemon.com/tools/traceroute/definition.shtml