Tracert to a subnet broadcast – Answer (2)

By certskills June 24, 2015 09:05

This latest practice question looks at how a particular tracert command works. The previous explanation looked at the logic that occurred for all the TTL=1 packets. Today’s post next looks at all the TTL=2 packets created by the tracert command, with the final answer post looking at the TTL=3 packets.

To review, host A issues a tracert command, sending IP packets destined to, the broadcast address in subnet, located off R3. The TTL=1 packets are discarded by R2 (the first router). Next, we’ll discuss the TTL=2 packets, and R3’s reaction.

Walking through the process in sequence, consider the first packet, an ICMP Echo Request, with TTL=2 and destination IP address in the IP header as it leaves host A. As discussed in part 1 of the answers to this question, host A sends these packets to its default gateway (R2).

Once the TTL=2 packet arrives at R2, R2:

  1. Decrements the TTL to 1
  2. Decide where to route the packet based on destination IP address

As it turns out, when matching a route for a remote subnet, the local router makes no distinction about whether the destination address may or may not be a subnet broadcast address. In this case, depending on the routing protocol in use and how it is configured, R2 might learn a route to, or to the entire class C network However, in either case, R2 doesn’t know for sure that the route is for a real subnet, or whether the route is a summarized route… so R2 does a simple match, with this logic:

Does destination match any of my existing subnets? If so, forward with that route.

The above is the hard part of today’s logic. Given that R2 forwards these packets (now TTL=1) to R3, let’s pick up the story as the packets arrive at R3.

When a TTL=1 packet arrives at R3, R3:

  1. Decrements the TTL to 0
  2. Discards the packet
  3. Sends a Time Exceeded back to the sender (host A), so that host A can list R3’s address as the 2nd router listed in the tracert command output

Most notably, R3 decrements TTL to 0, discarding the packet, before thinking about forwarding the packet. So we’ll leave that till part 3 of the explanation for this question.

Question and Answers

As for the question and answers…

We now know that the tracert output on host A will list both R2 and R3 ( and, respectively). As a result, answers A, B, and C cannot be correct, but answers D and E are still possibles. (The previous answer post had already ruled out answers A and B for other reasons, by the way.)

Next post, we’ll look at the TTL=3 packets generated by host A’s tracert command, which forces R3 to think about whether to forward the packets or not, and if forwarding, what to do. That’ll reveal whether D or E is correct. That post is planned for a few days from now!


traceroute to a subnet broadcast - Answer (1)
Tracert to a Subnet Broadcast: Answer (3)
By certskills June 24, 2015 09:05
Write a comment

1 Comment

View comments

Write a comment

Comment; Identify w/ Social Media or Email


Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.