Protocol fundamentals – Traceroute differences between Windows and Linux

My last post about Traceroute over here: – got some interesting conversation going on in the comments.

Basically there is quite a big difference in the way in which Windows and Linux handle traceroute. I tested on both Windows 7 and Ubuntu 10.04, but my guess is that all Windows follow the same format as do all *nix’s (please let me know if otherwise though!)

I would recommend reading the above post again quickly to get all the basics out the way before we delve into the differences.

Step-wise, this is what happens on Windows:

  1. The OS send a DNS PTR request to to get the hostname for
  2. I get a DNS PTR response giving me a hostname
  3. The OS send an ICMP ECHO request with a TTL of 1
  4. I get an ICMP TTL Exceeded packet back from my local router
  5. 3 & 4 above happens twice more
  6. The OS send a DNS PTR request to my local router
  7. My local router responds with it’s hostname
  8. The cycle above (3-7) is then repeated with a TTL of 2, then 3 and so on
  9. We finally get to – which sends back an ICMP ECHO reply – Once I get 3 the job is complete.

Ubuntu does this completely differently though. Step-wise this is what’s going on:

  1. The OS immidiately sent 3 UDP packets with a high port number straight to with a TTL of 1
  2. The local router responded with 3X ICMP TTL Exceeded message
  3. The above (1 & 2) is then repeated until we get to
  4. does not generate a ICMP ECHO reply as an ECHO request was not sent. Rather we get 3 ICMP Code 3 (Port unreachable) replies
  5. The OS now throws out 7 DNS PTR request specifically to each IP it determined in the path from above (Including iself!)
  6. As soon as all the replies come, the job is complete.

The main differences are that Windows will send a DNS PTR request from the start, then send ICMP ECHO requests. At each hop it’ll send a DNS PTR request and then move onto the next hop.
Linux starts with sending UDP packets to a high port number straight away. When it finally gets to the last hop it’ll then send out a mass DNS PTR request to every hop in the path that it has determined.

10 Replies to “Protocol fundamentals – Traceroute differences between Windows and Linux”

  1. Nice, was thinking about write about it myself :) The only reason for this behaviour that I could find is that an old RFC stated that ICMP packets should not get a reply with another ICMP packet because it could lead to a never ending stream of ICMP packets. This was later changed to ICMP error packets should not get an ICMP error packet back. This is the reason for the behaviour in Linux as far as I can tell but I’m not sure.

  2. *nix style traceroutes will generally show multiple paths because of the way the traffic is sent. Windows type traceroutes only show a single path

  3. There is a subtle difference between tracert in XP (and earlier windows systems) and Windows 7. On XP, the first hop (my router/modem) always fails to resolve, whereas on Windows 7 it resolves correctly. I’m not sufficiently technical to understand why…

Leave a Reply

Your email address will not be published. Required fields are marked *