tracerunner

A trick with a counter

Every IP packet carries a small number called its time to live. Each router that forwards the packet takes one off; a router that takes it to zero throws the packet away and, as a courtesy, sends a short note back to the sender saying so: time exceeded. The counter exists so that a packet caught in a routing loop dies instead of circling forever.

In 1987, at Lawrence Berkeley Laboratory, Van Jacobson turned that courtesy into a map. Send a packet with a time to live of one, and the first router on the path answers. Send one with two, and the second answers. Keep counting up until the destination itself replies, and the notes that come back name every hop in between, with how long each took. Its manual page credits the idea to a suggestion from Steve Deering, and the debugging to "a cast of thousands". The program was traceroute.

What the map leaves out

It was never a picture of the network, only of what one path looked like from one place at one moment. Routers that don't answer show up as stars. Replies may come back by another road than the probes went out on. When networks began spreading traffic over several equal paths, consecutive probes could take different branches, and traceroute would stitch hops from different paths into one line that didn't exist. Paris traceroute (2006) fixed much of that by keeping each probe's headers looking alike to the balancers, so that they all took the same branch.

Others carried the idea further. mtr (1997) ran traceroute over and over and kept statistics per hop. Variants used TCP or ICMP echo instead of UDP so they could get past firewalls. Measurement projects ran it from thousands of vantage points at once, so that the paths from many places could be laid side by side.

Paths over time

The lesson that carried over is that a path is an observation, not a fact: who saw it, from where, when, and how sure they were. Run it again tomorrow and the answer may differ, and the difference is often the interesting part.