Using Tracert to Monitor the Forwarding Path on an IPv4 or IPv6 Network

The tracert command is used to monitor link connectivity and locate network faults.

Context

The tracert/tracert ipv6 command is used to discover gateways through which a message passes from the source to the destination. The maximum TTL value set for the UDP packet sent using the tracert/tracert ipv6 command is 255. Each time the source does not receive a reply after the configured time elapses, it displays the TTL of the UDP packet as expired and sends another UDP packet with the TTL value increasing by 1. If the TTL value remains expired for 255 times, the source considers that the UDP packet cannot reach the destination and the trace test fails.

To reduce exposure of the IP/IPv6 addresses of device interfaces in order to prevent against detection through Port Unreachable or Time Exceeded messages, specify the source IP/IPv6 address of Port Unreachable or Time Exceeded messages in the loopback interface view. If the tracert/tracert ipv6 command is run to detect a remote IP/IPv6 address, the device uses the IP/IPv6 address of the loopback interface to function as the source IP/IPv6 address of Port Unreachable or Time Exceeded messages.

Procedure

On an IPv4 network:
1. (Optional) Configure the IP address of the loopback interface as the source IP address of ICMP Port Unreachable or Time Exceeded messages.
  1. Run system-view
    
    The system view is displayed.
  2. Run interface loopback loopback-number
    
    A loopback interface is created, and the loopback interface view is displayed.
  3. (Optional) Run ip binding vpn-instance vpn-instance-name
    
    The interface is bound to a VPN instance.
  4. Run ip icmp { ttl-exceeded | port-unreachable } source-address
    
    The IP address of the loopback interface is configured as the source IP address of ICMP Port Unreachable or Time Exceeded messages.
  5. Run commit
    
    The configuration is committed.
2. Run tracert [ -a source-ip-address | -f initTtl | -m maxTtl | -p destPort | -q nqueries | { -vpn-instance vpn-instance-name [ peer peerIpv6 ] | -as } | -w timeout | -v | -s size | -i { interface-name | interface-type interface-number } | -name | { -tos tos-value | -dscp dscp } | -nexthop nexthop-address | -passroute | -service-class classValue ] ^* host
  
  The fault is located.
  
  If the -as keyword is configured, the AS number of each hop is obtained by querying the local routing table based on the response address. The AS number is displayed only when the corresponding routing entry is learned through BGP and the BGP route carries the AS number.
  
  The following example uses the tracert command to analyze the network.
```
<HUAWEI> tracert -m 10 10.1.1.1
traceroute to 10.1.1.1 (10.1.1.1), max hops: 10 ,packet length: 40,press CTRL_C to break
1  172.16.112.1   19 ms   19 ms   1 ms
2  172.16.216.1   39 ms   39 ms   19 ms
3  172.16.136.23   39 ms   40 ms   39 ms
4  172.16.168.22   39 ms   39 ms   39 ms
5  172.16.197.4   40 ms   59 ms   59 ms
6  172.16.221.5   59 ms   59 ms   59 ms
7  172.31.70.13   99 ms   99 ms   80 ms
8  172.31.71.6   139 ms   239 ms   319 ms
9  172.31.81.7   220 ms   199 ms   199 ms
10 10.1.1.1   239 ms   239 ms   239 ms
```
On an IPv6 network:
1. (Optional) Configure the IPv6 address of the loopback interface as the source IPv6 address of ICMPv6 Port Unreachable or Time Exceeded messages.
  1. Run system-view
    
    The system view is displayed.
  2. Run interface loopback loopback-number
    
    A loopback interface is created, and the loopback interface view is displayed.
  3. (Optional) Run ip binding vpn-instance vpn-instance-name
    
    The interface is bound to a VPN instance.
  4. Run ipv6 enable
    
    IPv6 is enabled on the interface.
  5. Run ipv6 icmp { hop-limit-exceeded | port-unreachable } source-address
    
    The IPv6 address of the loopback interface is configured as the source IPv6 address of ICMPv6 Port Unreachable or Time Exceeded messages.
  6. Run commit
    
    The configuration is committed.
2. Run tracert ipv6 [ -f first-hop-limit | -m max-hop-limit | -p port-number | -q probes | -w timeout | { vpn-instance vpn-instance-name [ peer peerIpv6 ] } | -s size | -name | -a source-ipv6-address | -v | -nexthop nextHopAddr | -passroute | { -tc tc | -dscp dscp } | -service-class classValue ] ^* host-name [ -i { ifName | ifType ifNum } ]
  
  The fault is located.
  
  The following example uses the tracert ipv6 command to analyze the network.
```
<HUAWEI> tracert ipv6 -q 5 -w 8000 2001:db8:100::3
traceroute to 2001:db8:100::3 30 hops max,60 bytes packet
1 2001:db8:200::2 26 ms 23 ms 26 ms 30 ms 29 ms 
2 2001:db8:100::3 3020 ms 3024 ms 4040 ms 6820 ms 5584 ms
```