21

tracert returns requested time out. What I understand from this is the packets lost some where on the network.

Does it mean the issue is with the ISP or with the hosting provider or my windows system?

10     *        *        *     Request timed out.
11     *        *        *     Request timed out.
12     *        *        *     Request timed out.
13     *        *        *     Request timed out.
14     *        *        *     Request timed out.
15     *        *        *     Request timed out.
16     *        *        *     Request timed out.
17     *        *        *     Request timed out.
18     *        *        *     Request timed out.
19     *        *        *     Request timed out.
20     *        *        *     Request timed out.
21     *        *        *     Request timed out.
22     *        *        *     Request timed out.
23     *        *        *     Request timed out.
24     *        *        *     Request timed out.
25     *        *        *     Request timed out.
26     *        *        *     Request timed out.
27     *        *        *     Request timed out.
28     *        *        *     Request timed out.
29     *        *        *     Request timed out.
30     *        *        *     Request timed out.

The first 9 were successful.

Raghav
  • 6,893
  • 3
  • 19
  • 28

5 Answers5

20

I can't see the first 9 hops but if they are all the same then you may have a firewall configuration issue that prevents the packets from either getting out or getting back.

Try again turning off your firewall (temporarily!). The other option is that your ISP may drop ICMP traffic as a matter of course, or only when they are busy with other traffic.

ICMP (the protocol used by traceroute) is of the lowest priority, and when higher priority traffic is ongoing the router may be configured to simply drop ICMP packets. There is also the possibility that the ISP drops all ICMP packets as a matter of security since many DOS (Denial of Service) attacks are based on probing done with ICMP packets.

Aage
  • 5,932
  • 2
  • 32
  • 57
John Faulkner
  • 990
  • 7
  • 10
  • No first 9 hops are not the same. Only those posted are request timed out. I tried by turning off the firewall. Still the same issue – Raghav Jun 28 '13 at 04:09
  • 2
    then it is likely that the 10th hop is dropping ICMP packets and they are not being passed on. If the first 9 show response times then its not you, and not likely to be your ISP either, unless they have many routers involved in the transport. – John Faulkner Jun 28 '13 at 04:36
  • 3
    for your educational enjoyment, this is a very good traceroute tutorial. http://networking.ringofsaturn.com/IP/traceroutedoc.php – John Faulkner Jun 28 '13 at 04:41
3

Some routers view all pings as a Port-Scan, and block for that reason. (as the first step in any attack is determining which ports are open.) However, blocking ping packets / tracert packets, etc. is only partially effective at mitigating a Denial-of-service attack, as such an attack could use ANY PROTOCHOL it wanted (such as by using TCP or UDP packets, etc.) So long as there is an open port to receive the packet on the machine targeted for Denial-Of-Service. For example, if we wanted to target an http server, we only need use an intercepting proxy to repeatedly send a null TCP packet to the server on port 80 or port 8080, since we know that these are the two most common ports for http. Likewise, if the target machine is running an IRCd, we know the port is most likely 6667 (unless the server is using SSL), which would be the most common port for that kind of service. Therefore, dropping ping packets does not prevent a DdOS attack- it just makes that type of attack a bit more difficult.

John Doe
  • 51
  • 3
0

This is what I found from the Wireshark documentation(I had the same problem):

"The tracert program provided with Windows does not allow one to change the size of the ICMP message sent by tracert. So it won’t be possible to use a Windows machine to generate ICMP messages that are large enough to force IP fragmentation. However, you can use tracert to generate small,fixed-length packets"

https://danielgraham.files.wordpress.com/2021/09/wireshark_ip_v8.1-2.pdf

Rohi.98
  • 7
  • 4
0

use tracert -h 1 this will limit the number of times it tries a particular ip address to 1 try. h = hops. I had written a batch script a while back to scan my entire network to get a list of ips and computer networks and it would waste time on the fire wall that wouldnt answer and ip addresses that weren't assigned to any computers. Wicked annoying!!!!!! so I added the -h 1 to the script!! I runs through and makes a list in a text file. I hope to improve it in the future by running arp -a first to get a quck list of ips, then feeding that list into a script similar to this one. that way it doesn't waste time on unassigned IP's.

enter code here@echo off

enter code hereset trace=tracert enter code hereset /a byte1=222 enter code hereset /a byte2=222 enter code hereset /a byte3=222 enter code hereset /a byte4=100

enter code hereset loop=0 enter code here:loop enter code here@echo enter code here%trace% %byte1%.%byte2%.%byte3%.%byte4%>>ips.txt enter code hereset /a loop=%loop% + 1

enter code hereset /a byte4=%byte4% + 1 enter code here@echo %byte4% enter code hereif %loop%==255 goto next enter code heregoto loop enter code here:next enter code hereend

Kevin Cottam
  • 1
-5

Your antivirus blocks the incoming packets , and in no case this option can be turned off because its the basic property of an antivirus i.e to block packets to prevent computer from normal as well as DOS (Denial of Service) attacks .

Ujjwal
  • 1