Given this topic is very basic and small but its allways good to have those informations handy, you never know when you need it 🙂
Cisco’s Traceroute implementation uses a mix of UDP and ICMP packets. A Cisco devices sends 3 UDP packets (default) with an invalid port address and a TTL of 1. Since the TTL is set to one the first router in the path will send a time to live exceeded in transit message (ICMP Type 11, Code 0) back to the source, since its not the target of the packet but it cannot forward the packet to the next hope due to the TTL of 1.
After the device received the 3 ICMP packets it will send 3 UDP packets again but this time with a TTL of 2. The same process recurs until the destination is reached. The destination then will send destination unreachable (port unreachable) messages (ICMP type 3, code 3) instead of the time to live exceeded messages. The traceroute process then knows that it reached the destination and the process can be stopped.
The device can build the path to the destination based on the ICMP messages, since those messages use the interface towards the source device as their source address.
The following table shows output characters for the traceroute command:
|nn msec||Displays the round trip delay for each try and note in milliseconds (Default is 3 tries)|
|*||The try timed out (Default is 3 seconds)|
|A||Administratively prohibited, such as via an ACL|
|Q||Source Quench, the target is too busy to answer|
|I||User interrupted test|
|?||Unknown packet type|