need explanation in relation between tracert and ping

[Dr.X]

hi

i have a questions:

when i  perform a ping from my pc to a router  , i note that TTL= 237 which means that there are alot of hops untill i reach my destination. but when i perform tracert  i have only 2 hops !!!!

my question is ,  why the TTL was not 254 ????? shoudlnot  it be 254 because i have only  1 hop from tracert  ???

ive enclosed my result ,

im very sorry becuse i replaced the ips with xx ,

=======================================

C:\Documents and Settings\mcom>tracert xx.xx.90.13

Tracing route to xx.xx.90.13 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  xx.58.64.1

  2    86 ms    85 ms    86 ms  xx.xx.90.13

Trace complete.

=======================================

C:\Documents and Settings\mcom>ping xx.xx.90.13

Pinging xx.xx.90.13 with 32 bytes of data:

Reply from xx.xx.90.13: bytes=32 time=86ms TTL=237

Reply from xx.xx.90.13: bytes=32 time=86ms TTL=237

Reply from xx.xx.90.13: bytes=32 time=87ms TTL=237

Reply from xx.xx.90.13: bytes=32 time=87ms TTL=237

Ping statistics for xx.xx.90.13:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 86ms, Maximum = 87ms, Average = 86ms

==========================================

Thanks

[nkarpysh]

Hi

Do you have MPLS between your PC and remote host you ping? If yes that that explains the things. MPLS can encapsulate TTL in its header and decrease it along the MPLS path thus regular ping showing ttl decreased.

Tracert in turn send packets with TTL=1, TTL=2, TTL=3, etc to reach each hop by hop in turn. But MPLS switches will not answer those pings and just translate answer across, thus you see only two hops - one before MPLS and another after MPLS I guess.

Nik

[Dr.X]

i think that im using mpls , because im an isp ,

the problem is when i ping form my internal network "public ips" , i find the ping 237 , but when i make traceroute i note that only two hops  !!

it seems that the packet reaced the destination from the internet , not from my internal network !!!

but my question , why my traceroute hops werenot  the real hops which actually happened

[ebarticel]

It depends what default gateway the PC has. All layer 3 devices will add a hop to the tracert command

[Dr.X]

mr ,

eugen barticel

i know that , but i want to know why the hops are only 2  from traceroute ??? , why the hops were not 20 hops  from tracroute ????

[nkarpysh]

Ahmed,

MPLS switches do not answer ICMP as those are L2 only - thus you are not seeing all those MPLS hops in between. Though when you ping MPLS is able to reduce TTL thus you see it reduced.

Tha is it.

Nik

[ebarticel]

Because the traceroute command stops when it reaches the destination ( when it receives a icmp replay from the destination ip). You see that the maximum hops is set to 30, but it will terminate when it reaches the destination IP.

The ping send 4 icmp packets (5 on the router) and receives 4, thats why the TTL is set so high( TTL value is different depending on what OS you use on the PC),

Eugen

[Richard Burts]

Eugen makes a good point. Ahmed is assuming that the TTL starts at 255. That may be the case or it may not be the case and it depends on the remote host. Each implementation of the IP stack makes a decision about what to use for TTL. It is free to choose any value up to a maximum of 255. And some implementations choose values that are lower than 255. So unless we know the remote host and know what it sets as TTL we should be very careful about assumptions of what is the TTL.

HTH

Rick