Not understanding traceroute output

[katerina.dardoufa]

Hello community,

I did a traceroute command and I do not fully understand the output. This is what I got:

Sw-KK-C6509-R4A1#traceroute 192.168.1.75

Type escape sequence to abort.

Tracing the route to 192.168.1.75

  1 10.150.254.4 0 msec

    10.250.200.34 0 msec

    10.150.254.4 0 msec

  2 10.170.254.3 0 msec

    10.250.200.41 0 msec

    10.170.254.3 0 msec

  3 10.130.254.4 0 msec

    10.250.200.37 0 msec

    10.130.254.4 4 msec

  4 10.130.252.1 0 msec 0 msec 0 msec

  5 10.255.197.66 32 msec *  28 msec

Why do I get 3 lines for each hop? Do some of the packets go through one path and some through another?

Show ip route also shows that it learns about 192.168.1.75 from 2 different sites, with the same metric!

Sw-KK-C6509-R4A1>sh ip route 192.168.1.75

Routing entry for 192.168.1.75/32

  Known via "ospf 1", distance 110, metric 50

  Tag Complete, Path Length == 1, AS 6799, , type extern 2, forward metric 6

  Last update from 10.150.254.4 on Vlan254, 1d11h ago

  Routing Descriptor Blocks:

  * 10.250.200.34, from 10.255.198.5, 1d11h ago, via GigabitEthernet1/23

      Route metric is 50, traffic share count is 1

      Route tag 3489667727

    10.150.254.4, from 10.255.198.5, 1d11h ago, via Vlan254

      Route metric is 50, traffic share count is 1

      Route tag 3489667727

Is the route marked with * preffered and if yes, why does it say:

Last update from 10.150.254.4 on Vlan254

192.168.1.75 goes through the providers MPLS, so I don't know if anything changed in the providers network, because I have the same issue with all branches belonging to the same OSPF area.

Thank you all in advance,

Katerina

[Calin C. · Accepted solution]

You have there multiple routes for the same destination (subnet). The asterisk doesn't mean that route is preferred in terms that is the only route that packets take. Instead, I quote here as it's easier:

There is also an asterisk (*) next to one of  the block entries. This corresponds to the active route that is used for  new traffic. The term 'new traffic' corresponds to a single packet or  an entire flow to a destination, depending on the type of switching  configured.


For process-switching—load balancing is on a per-packet basis and the  asterisk (*) points to the interface over which the next packet is  sent.


For fast-switching—load balancing is on a per-destination basis and  the asterisk (*) points to the interface over which the next  destination-based flow is sent.

The position of the asterisk (*) keeps rotating among the equal cost paths each time a packet/flow is served.

You can see here an example:

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094820.shtml

I'll show you an example from my live environment. I have one router with two uplinks. The routing protocol is OSPF and the uplink routers both send a default route with the same metric:

sh ip route 0.0.0.0

Routing entry for 0.0.0.0/0, supernet

  Known via "ospf 1", distance 110, metric 11, candidate default path

  Tag 1, type extern 1

  Last update from x.x.x.145 on TenGigabitEthernet2/1, 1d00h ago

  Routing Descriptor Blocks:

    x.x.x.145, from x.x.x.16, 1d00h ago, via TenGigabitEthernet2/1

      Route metric is 11, traffic share count is 1

      Route tag 1

  * x.x.x.129, from x.x.x.15, 1d00h ago, via TenGigabitEthernet2/2

      Route metric is 11, traffic share count is 1

      Route tag 1

traceroute 1.1.1.1

Type escape sequence to abort.

Tracing the route to 1.1.1.1

  1 x.x.x.145 0 msec

    x.x.x.129 0 msec

    x.x.x.145 0 msec

  2 x.x.x.221 0 msec

    x.x.x.225 0 msec

    x.x.x.221 0 msec

  3 x.x.x.114 12 msec 12 msec 12 msec

  4 x.x.x.70 20 msec 12 msec 16 msec

I took out the subnet for security reasons, but the last octet the important one here.

HTH,

Calin

[katerina.dardoufa]

Thanks Calin,

The answer fully covers my questions!