1

traceroute:

When trying to trace route for facebook.com (I am from India), I get below response. Now, as per the lecture, first few IP addresses or router names are the nearest routers to me. But 1st and 2nd hops have IP addresses starting from 172.23.130 which looks closer to Facebook's IP — 173.252.120.6.

  • So, I am not able to understand the 172.23.130 part. 4th hop is making sense to me because its IP is 115.113.207.157. Am I interpreting wrongly?
  • Last hop is edge-star-shv-12-frc3.facebook.com [173.252.120.6], so edge-star-shv-12-frc3.facebook.com is the name of last router or what? And then why is the IP address in square brackets?
Tracing route to facebook.com [173.252.120.6]
over a maximum of 30 hops:

  1    78 ms    88 ms    81 ms  172.23.130.4
  2    63 ms    80 ms    64 ms  172.23.130.91
  3    79 ms    82 ms    62 ms  172.29.244.245
  4    69 ms    58 ms    78 ms  115.113.207.157.static-hyderabad.vsnl.net.in [115.113.207.157]
  5    81 ms   100 ms    79 ms  172.25.81.134
  6     *        *        *     Request timed out.
  7   101 ms    74 ms    99 ms  115.114.85.233
  8     *      223 ms   203 ms  if-9-5.tcore1.WYN-Marseille.as6453.net [80.231.217.17]
  9   229 ms   228 ms   229 ms  if-8-1600.tcore1.PYE-Paris.as6453.net [80.231.217.6]
 10   224 ms   228 ms   223 ms  if-2-2.tcore1.PVU-Paris.as6453.net [80.231.154.17]
 11   227 ms   212 ms   226 ms  80.231.153.66
 12     *        *        *     Request timed out.
 13   300 ms   281 ms   304 ms  4.16.72.186
 14   331 ms   339 ms   339 ms  be12.bb01.iad3.tfbnw.net [31.13.24.56]
 15   314 ms   337 ms   332 ms  ae28.bb04.frc3.tfbnw.net [204.15.21.112]
 16   351 ms   305 ms   332 ms  ae4.dr06.frc1.tfbnw.net [31.13.25.127]
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21   327 ms   331 ms   313 ms  edge-star-shv-12-frc3.facebook.com [173.252.120.6]


nslookup:

As I understand, nslookup gives the IP address of a domain name.

  • Am I correct in this understanding that it is not the IP address of the server which will be serving the web request?
  • Then what exactly is this IP address of? Is it IP address of the load balancer or domain name server?
1

So, I am not able to understand 172.23.130 part. 4th hop is making sense to me because its IP is 115.113.207.157 Am I interpreting wrongly?

so I have done a quick search and read about the way traceroute works. you should probably understand that too in order to understand the possible explanation that I'm offering in this answer.

How traceroute works:

traceroute utilizes something called Internet Protocol (IP) packets. you may think of an IP packet as a virtual envelope. the message inside this envelope has a field called time to live (TTL). this field could hold an integer that represents the max number of hops that this packet travels.

in other words, as a packet travels, the current router decrements the value of the TTL field of this packet before sending it to the next router unless the value of the TTL field becomes 0 in which case a response called ICMP "time exceeded" response is sent back to the sender from the current router.

it is through this response that traceroute knows information about this router (e.g., its IP address).

two other things in the message sent by your machine are the IP address of the destination (in this case, an IP address of one of Facebook's servers) and a destination port that is typically known to be unavailable.

if a packet reaches the destination on the unavailable port, the host responds with a response known as ICMP "port unreachable" in which case traceroute knows this is the final destination.

so basically traceroute sends a packet to the destination on the destination port with a TTL value of 1. as the packet hits the first router (typically your gateway), the TTL value gets decremented to 0 and an ICMP "time exceeded" response is sent back from your gateway to your machine and your gateway is shown in the path.

then traceroute sends a packet with a TTL value of 2, so the second hop is shown in the path. this process repeats until the final destination is reached or the maximum number of hops (typically 30 by default) is reached.

Possible Explanations:

apparently some routers do not decrease TTL values and others do not reveal information about themselves. such routers are not shown in the traceroute path or asterisks are shown respectively. so this could be a reason why you're not seeing particular hops.

another point to take per the Wikipedia article is that

Internet Protocol does not require packets to take the same route towards a particular destination, thus hosts listed might be hosts that other packets have traversed

this could be the reason why you're not seeing them in order.


Last hop is edge-star-shv-12-frc3.facebook.com [173.252.120.6], so edge-star-shv-12-frc3.facebook.com is the name of last router or what? And then why is the IP address in square brackets?

yes, it is the name of the host that you wanted to reach in this case. and I'm not sure what's problem with the square brackets. they're just emphasizing the IP address of the host in this case.


As I understood nslookup gives the IP address of the domain name.

  • Am I correct in this understanding that it is not the IP address of the server which would be serving the web request?

no, you're not.

  • Then what exactly is this IP address of? Is it IP address of the load balancer or domain name server?

it's the IP address of a server that is to serve your request. in your example, it's the IP address of one of Facebook's servers. so basically nslookup mapped www.facebook.com to 173.252.120.6 through a domain name server (DNS).


update:

I think trace route will send just one packet of some size and will trace the route from it, and if it fails then it fails. It doesn't give another try.

quoted from man traceroute:

This program attempts to trace the route an IP packet would follow to some internet host by launching probe packets with a small ttl (time to live) then listening for an ICMP "time exceeded" reply from a gateway. We start our probes with a ttl of one and increase by one until we get an ICMP "port unreachable" (or TCP reset), which means we got to the "host", or hit a max (which defaults to 30 hops).

so no, traceroute does not send only one packet. it first sends a packet with a TTL of 1, the first hop on the way decrements that value to 0, and sends "ICMP time exceeded" response back to your machine which enables traceroute to identify the router that represents that hop.

then traceroute sends a packet with a TTL of 2, the first router on the way decrements it to 1, then sends it to the second router which decrements it to 0 and sends "ICMP time exceeded" response back to your machine and so on.

this keeps going on until your machine gets "port unreachable" response in which case either the destination or max number of hops is reached.

this is just the way it works.

I don't think that edge-star-shv-12-frc3.facebook.com [173.252.120.6] is the "name of the host".

I think you're a little confused.

(1.) I should be able to open facebook using edge-star-shv-12-frc3.facebook.com

well, you can. try pasting that in a browser and hitting Enter, you should see Facebook opening.

(2.) when i ping edge-star-shv-12-frc3.facebook.com I should be able to get the IP of facebook.com, but when i ping facebook.com then i get 173.252.110.27

in fact 173.252.110.27 belongs to Facebook. Facebook is actually hosted on many servers. edge-star-shv-12-frc3 is the name of one of these machines and of course 173.252.110.27 is the IP address of this machine.

I still don't understand that when do traceroute for any website then why i get 172.23.130.4 as first hop or router IP?

I'm not really a network expert. I didn't quite know that 172.23.130.4 is a private IP until recently when I read more. in fact it would make sense that represents a hop on your local network.

| improve this answer | |
  • Thank you for your inputs. You explanation about TTL in How traceroute works:, you starts by saying that TTL is decremented at each hop, which is infact true, but then in the end of same section you are suggesting that another packet with incremented value. It is little unclear, probably you wanted to explain from packets point to view, but it was unclear. I think trace route will send just one packet of some size and will trace the route from it, and if it fails then it fails. It doesn't give another try. – hagrawal Aug 8 '15 at 18:59
  • I don't think that edge-star-shv-12-frc3.facebook.com [173.252.120.6] is the "name of the host". For it to be true - (1.) I should be able to open facebook using edge-star-shv-12-frc3.facebook.com (2.) when i ping edge-star-shv-12-frc3.facebook.com I should be able to get the IP of facebook.com, but when i ping facebook.com then i get 173.252.110.27. So, I think edge-star-shv-12-frc3.facebook.com [173.252.120.6] is the last router name and IP in square bracket is IP of that router. – hagrawal Aug 8 '15 at 19:04
  • I still don't understand that when do traceroute for any website then why i get 172.23.130.4 as first hop or router IP? – hagrawal Aug 8 '15 at 19:05
  • @hagrawal please read the update section in the answer above! – Kareem Aug 8 '15 at 20:54
  • Thanks for your inputs. Your inputs have cleared many of my doubts, just few more to go. (1) I was under impression that "traceroute" only gives the router information, but I think each hop could be a router or gateway or actual host. Right? (2) I tried this command nslookup 173.252.110.27 and I got Name: edge-star-shv-13-frc1.facebook.com, so I think you are indeed right. You also said it right that FB or any large scale web site will be hosted on my servers, so this means they would be load balancing.But now edge-star-shv-13-frc1.facebook.com is a hosting server or a load balancer. – hagrawal Aug 9 '15 at 13:47
1

I am not able to understand the 172.23.130 part.

That is your private, local IP address. IP addresses in the ranges 172.16.0.0 - 172.31.255.255 and 192.168.0.0 - 192.168.255.255 are private, meaning that this is your IP on your LAN (your local network). In other words, it is the address by which you are identified to others on the same network as you. For example, if you have a home router, you and others connected to the same router might have IP addresses of 172.31.xx.xx, but all of you on that router would identified to those not connected to your LAN (i.e., the rest of the internet) by a different IP address. In this case, that seems to be 115.113.207.157.

See more here: https://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces

| improve this answer | |
  • I know that 172.16.#.# - 172.31.#.# range is reserved for private ID addresses but I am not sure if the LAN part of your answer is correct. I am connected through some ISP and so directly connected through their network and not in some LAN. For this to be true that I am in my ISP's LAN, then (1.) does it mean that when I am working from some office which is providing me internet connectivity then I am in LAN of that office and also LAN of the office ISP. No, right? – hagrawal Aug 8 '15 at 18:54
  • (2.) if I am in ISP's LAN then I should be able to ping (and even access shared folders) one of the IP's in range of private IP address, but if I write a script to ping all possible private IP address then I will not get successfully ping even for one. So, I don't think that I am in LAN of my ISP. – hagrawal Aug 8 '15 at 18:54
  • 1
    Your ISP does not have a LAN - you would have one at home (see here en.wikipedia.org/wiki/Local_area_network). Are you connected to a router (typically wireless these days) that is connected to your modem? If so, you are on a LAN. And if no one else is connected to that router, your LAN is effectively composed of only one node - you. To your point, then, traceroute starts with you, then your router (which has the IP address assigned by your ISP, and then outwards). For example, when I run traceroute facebook.com, the first address is 192.168.2.1 - my IP address on my LAN. – L.B. Aug 9 '15 at 1:16
  • I am connected with a WIFI device given by my ISP and it is not connected with any modem. I think this WIFI device is directly connected to my ISP's network, so I get signal from it, now through their n/w my WIFI will send IP packets to their router, and so on... Am I correct? – hagrawal Aug 9 '15 at 13:21
  • 1
    Yes, but - 1. That wifi device likely serves as a local router creating your LAN. 2. It sounds like that device is also your modem, which you do need to have in order to connect to your ISP. – L.B. Aug 9 '15 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .