So, I am not able to understand 172.23.130 part. 4th hop is making
sense to me because its IP is 115.113.207.157 Am I interpreting
wrongly?
so I have done a quick search and read about the way traceroute works. you should probably understand that too in order to understand the possible explanation that I'm offering in this answer.
How traceroute works:
traceroute utilizes something called Internet Protocol (IP) packets. you may think of an IP packet as a virtual envelope. the message inside this envelope has a field called time to live (TTL). this field could hold an integer that represents the max number of hops that this packet travels.
in other words, as a packet travels, the current router decrements the value of the TTL field of this packet before sending it to the next router unless the value of the TTL field becomes 0 in which case a response called ICMP "time exceeded" response is sent back to the sender from the current router.
it is through this response that traceroute knows information about this router (e.g., its IP address).
two other things in the message sent by your machine are the IP address of the destination (in this case, an IP address of one of Facebook's servers) and a destination port that is typically known to be unavailable.
if a packet reaches the destination on the unavailable port, the host responds with a response known as ICMP "port unreachable" in which case traceroute knows this is the final destination.
so basically traceroute sends a packet to the destination on the destination port with a TTL value of 1. as the packet hits the first router (typically your gateway), the TTL value gets decremented to 0 and an ICMP "time exceeded" response is sent back from your gateway to your machine and your gateway is shown in the path.
then traceroute sends a packet with a TTL value of 2, so the second hop is shown in the path. this process repeats until the final destination is reached or the maximum number of hops (typically 30 by default) is reached.
Possible Explanations:
apparently some routers do not decrease TTL values and others do not reveal information about themselves. such routers are not shown in the traceroute path or asterisks are shown respectively. so this could be a reason why you're not seeing particular hops.
another point to take per the Wikipedia article is that
Internet Protocol does not require packets to take the same route
towards a particular destination, thus hosts listed might be hosts
that other packets have traversed
this could be the reason why you're not seeing them in order.
Last hop is edge-star-shv-12-frc3.facebook.com [173.252.120.6], so
edge-star-shv-12-frc3.facebook.com is the name of last router or what?
And then why is the IP address in square brackets?
yes, it is the name of the host that you wanted to reach in this case. and I'm not sure what's problem with the square brackets. they're just emphasizing the IP address of the host in this case.
As I understood nslookup gives the IP address of the domain name.
- Am I correct in this understanding that it is not the IP address of
the server which would be serving the web request?
no, you're not.
- Then what exactly is this IP address of? Is it IP address of the load balancer or domain name server?
it's the IP address of a server that is to serve your request. in your example, it's the IP address of one of Facebook's servers. so basically nslookup mapped www.facebook.com to 173.252.120.6 through a domain name server (DNS).
update:
I think trace route will send just one packet of some size and will
trace the route from it, and if it fails then it fails. It doesn't
give another try.
quoted from man traceroute:
This program attempts to trace the route an IP packet would follow to
some internet host by launching probe packets with a small ttl (time
to live) then listening for an ICMP "time exceeded" reply from a gateway. We
start our probes with a ttl of one and increase by one until we get an
ICMP "port unreachable" (or TCP reset), which means we got to the
"host", or hit a max (which defaults to 30 hops).
so no, traceroute does not send only one packet. it first sends a packet with a TTL of 1, the first hop on the way decrements that value to 0, and sends "ICMP time exceeded" response back to your machine which enables traceroute to identify the router that represents that hop.
then traceroute sends a packet with a TTL of 2, the first router on the way decrements it to 1, then sends it to the second router which decrements it to 0 and sends "ICMP time exceeded" response back to your machine and so on.
this keeps going on until your machine gets "port unreachable" response in which case either the destination or max number of hops is reached.
this is just the way it works.
I don't think that edge-star-shv-12-frc3.facebook.com [173.252.120.6]
is the "name of the host".
I think you're a little confused.
(1.) I should be able to open facebook using
edge-star-shv-12-frc3.facebook.com
well, you can. try pasting that in a browser and hitting Enter, you should see Facebook opening.
(2.) when i ping edge-star-shv-12-frc3.facebook.com I should be able
to get the IP of facebook.com, but when i ping facebook.com then i get
173.252.110.27
in fact 173.252.110.27 belongs to Facebook. Facebook is actually hosted on many servers. edge-star-shv-12-frc3 is the name of one of these machines and of course 173.252.110.27 is the IP address of this machine.
I still don't understand that when do traceroute for any website then
why i get 172.23.130.4 as first hop or router IP?
I'm not really a network expert. I didn't quite know that 172.23.130.4 is a private IP until recently when I read more. in fact it would make sense that represents a hop on your local network.
