Netstat Status Messages Explained

This article is the continuation of the last post (Netstat Explained). Here I am trying to give the explanation for the Netstat Status messages.

CLOSE_WAIT: The socket connection has been closed by the remote peer, and the system is waiting for the local application to close its half of the connection.

CLOSED: The socket is not in use.

ESTABLISHED: The socket has an established connection between a local application and a remote peer.

FIN_WAIT_1: The socket connection has been closed by the local application, the remote peer has not yet acknowledged the close, and the system is waiting for it to close its half of the connection.

FIN_WAIT_2: The socket connection has been closed by the local application, the remote peer has acknowledged the close, and the system is waiting for it to close its half of the connection.

LAST_ACK: The socket connection has been closed by the remote peer, the local application has closed its half of the connection, and the system is waiting for the remote peer to acknowledge the close.

LISTEN: The socket is listening for incoming connections.  Unconnected listening sockets like these are only displayed when using the -a option.

SYN_RECEIVED: The socket has passively received a connection request from a remote peer.

SYN_SEND: The socket is actively trying to establish a connection to a Remote peer.

TIMED_WAIT: The socket connection has been closed by the local Application, the remote peer has closed its half of the connection, and the system is waiting to be sure that the remote peer received the last Acknowledgement.

UNKONOWN: The state of the socket is unknown.

This Article can be found at the blog section of www.dileepk.info

Netstat Explained

Netstat Explained

netstat (network statistics) is a command-line tool that displays network connections (incoming and outgoing), routing tables, and a number of network interface statistics. It is available on Unix, Linux, and Windows NT-based operating systems.

It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement

Traditionally, it is used more for problem determination than for performance measurement. However, the netstat command can be used to determine the amount of traffic on the network to ascertain whether performance problems are due to network congestion.

The netstat command displays information regarding traffic on the configured network interfaces, such as the following:

* The address of any protocol control blocks associated with the sockets and the state of all sockets
* The number of packets received, transmitted, and dropped in the communications subsystem
* Cumulative statistics per interface
* Routes and their status



Parameters

Parameters used with this command must be prefixed with a hyphen (-) . The screen shot examples I used here taken from the Linux distro Matriux. Below are the options available on netstat

matriux ~ # netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 17224
/tmp/ksocket-root/klaunchericERRb.slave-socket
unix 3 [ ] STREAM CONNECTED 17223
unix 2 [ ] STREAM CONNECTED 14169
/tmp/ksocket-root/konquerorMlNAjb.slave-socket
unix 2 [ ] STREAM CONNECTED 14165
/tmp/ksocket-root/konquerorpG8Q6b.slave-socket
unix 2 [ ] STREAM CONNECTED 14167
/tmp/ksocket-root/konqueror44sYWb.slave-socket
unix 3 [ ] STREAM CONNECTED 13781
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 13780
unix 3 [ ] STREAM CONNECTED 13776 /tmp/.ICE-unix/5389
unix 3 [ ] STREAM CONNECTED 13775
unix 3 [ ] STREAM CONNECTED 13774 /tmp/.X11-unix/X0
unix 5 [ ] STREAM CONNECTED 13773
unix 2 [ ] STREAM CONNECTED 13600
/tmp/ksocket-root/konquerorqQigbc.slave-socket
unix 2 [ ] STREAM CONNECTED 13086
/tmp/ksocket-root/konquerorgpcBCb.slave-socket
unix 3 [ ] STREAM CONNECTED 12264
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 12263


-a : Displays all active TCP connections and the TCP and UDP ports on which the computer is listening.

matriux ~ # netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:7741 *:* LISTEN
tcp 0 0 192.168.100.183:42963 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42957 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42967 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42965 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42968 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42966 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42962 im-in-f83.google.c:http ESTABLISHED
udp 0 0 *:7741 *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:ipp *:*
raw 0 0 *:icmp *:* 7
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 10935 @/tmp/fam-root-
unix 2 [ ACC ] STREAM LISTENING 10667 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 10095
/var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 10845
/tmp/ksocket-root/kdeinit__0
unix 2 [ ACC ] STREAM LISTENING 10847
/tmp/ksocket-root/kdeinit-:0
unix 2 [ ACC ] STREAM LISTENING 10854
/tmp/.ICE-unix/dcop5370-1243447644
unix 2 [ ACC ] STREAM LISTENING 10885
/tmp/ksocket-root/klaunchericERRb.slave-socket
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 2 [ ACC ] STREAM LISTENING 10366 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 11313
/tmp/ksocket-root/matriux-1519-4a1d8160
unix 2 [ ACC ] STREAM LISTENING 11111 /tmp/.ICE-unix/5389

-b : Displays the binary (executable) program's name involved in creating each connection or listening port. (Windows XP, 2003 Server only (not Microsoft Windows 2000 or other non-Windows operating systems))

This is available only in windowds

-C : display routing cache instead of FIB (forward information database (FIB). This is the default.)

matriux ~ # netstat -C
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:58611 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:58609 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42967 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:58612 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42962 im-in-f83.google.c:http TIME_WAIT
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket
unix 3 [ ] STREAM CONNECTED 44847
unix 3 [ ] STREAM CONNECTED 44850
/tmp/ksocket-root/konquerorlmR3Hb.slave-socket

-c: Displays the information continuously

matriux ~ # netstat -c
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:42963 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42957 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42964 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42959 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42962 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42960 im-in-f83.google.c:http TIME_WAIT
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket
unix 3 [ ] STREAM CONNECTED 44847
unix 3 [ ] STREAM CONNECTED 44850
/tmp/ksocket-root/konquerorlmR3Hb.slave-socket
unix 3 [ ] STREAM CONNECTED 44834
unix 3 [ ] STREAM CONNECTED 44422 /tmp/.ICE-unix/5389
unix 3 [ ] STREAM CONNECTED 44421
unix 3 [ ] STREAM CONNECTED 44420 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 44417
unix 3 [ ] STREAM CONNECTED 44414
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44413

-e : Displays Ethernet statistics, such as the number of bytes and packets sent and received. This parameter can be combined with -s.

matriux ~ # netstat -e
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State User Inode
tcp 0 0 192.168.100.183:42954 im-in-f83.google.c:http
ESTABLISHED root 59102
tcp 0 0 192.168.100.183:57095 im-in-f83.google.c:http
ESTABLISHED root 58936
tcp 0 0 192.168.100.183:42955 im-in-f83.google.c:http
TIME_WAIT root 0
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http
ESTABLISHED root 59241
tcp 0 0 192.168.100.183:57093 im-in-f83.google.c:http
TIME_WAIT root 0
tcp 0 0 192.168.100.183:57094 im-in-f83.google.c:http
ESTABLISHED root 58912
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644

-F : Display Forwarding Information Base (this is the default, not available under Windows)

matriux ~ # netstat -F
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:58609 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42967 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:58607 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:58610 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:42962 im-in-f83.google.c:http ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket
unix 3 [ ] STREAM CONNECTED 44847
unix 3 [ ] STREAM CONNECTED 44850
/tmp/ksocket-root/konquerorlmR3Hb.slave-socket
unix 3 [ ] STREAM CONNECTED 44834
unix 3 [ ] STREAM CONNECTED 44422 /tmp/.ICE-unix/5389



-g: Display multicast group memberships

matriux ~ # netstat -g
IPv6/IPv4 Group Memberships
Interface RefCnt Group
--------------- ------ ---------------------
lo 1 ALL-SYSTEMS.MCAST.NET
eth1 1 ALL-SYSTEMS.MCAST.NET

-h : Displays Help for netstat

matriux ~ # netstat -h
usage: netstat [-veenNcCF] [] -r netstat {-V|--version|-h|--help}
netstat [-vnNcaeol] [ ...]
netstat { [-veenNac] -i | [-cnNe] -M | -s }

-r, --route display routing table
-i, --interfaces display interface table
-g, --groups display multicast group memberships
-s, --statistics display networking statistics (like SNMP)
-M, --masquerade display masqueraded connections

-v, --verbose be verbose
-n, --numeric don't resolve names
--numeric-hosts don't resolve host names
--numeric-ports don't resolve port names
--numeric-users don't resolve user names
-N, --symbolic resolve hardware names
-e, --extend display other/more information
-p, --programs display PID/Program name for sockets
-c, --continuous continuous listing

-l, --listening display listening server sockets
-a, --all, --listening display all sockets (default: connected)
-o, --timers display timers
-F, --fib display Forwarding Information Base (default)
-C, --cache display routing cache instead of FIB

={-t|--tcp} {-u|--udp} {-w|--raw} {-x|--unix} --ax25 --ipx --netrom
=Use '-6|-4' or '-A ' or '--'; default: inet
List of possible address families (which support routing):
inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)
netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)
x25 (CCITT X.25)

-i : Displays network interfaces and their statistics (not available under Windows)

matriux ~ # netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth1 1500 0 5026 0 0 0 1989 0
0 0 BMNRU
lo 16436 0 0 0 0 0 0 0
0 0 LRU

-l : Display the results of listening server sockets

matriux ~ # netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:7741 *:* LISTEN
udp 0 0 *:7741 *:*
udp 0 0 *:bootpc *:*
udp 0 0 *:ipp *:*
raw 0 0 *:icmp *:* 7
Active UNIX domain sockets (only servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 10935 @/tmp/fam-root-
unix 2 [ ACC ] STREAM LISTENING 10667 /tmp/.X11-unix/X0
unix 2 [ ACC ] STREAM LISTENING 10095
/var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 10845
/tmp/ksocket-root/kdeinit__0
unix 2 [ ACC ] STREAM LISTENING 10847
/tmp/ksocket-root/kdeinit-:0
unix 2 [ ACC ] STREAM LISTENING 10854
/tmp/.ICE-unix/dcop5370-1243447644
unix 2 [ ACC ] STREAM LISTENING 10885
/tmp/ksocket-root/klaunchericERRb.slave-socket
unix 2 [ ACC ] STREAM LISTENING 10366 /dev/gpmctl
unix 2 [ ACC ] STREAM LISTENING 11313
/tmp/ksocket-root/matriux-1519-4a1d8160
unix 2 [ ACC ] STREAM LISTENING 11111 /tmp/.ICE-unix/5389
unix 2 [ ACC ] STREAM LISTENING 10063 /var/run/acpid.socket
unix 2 [ ACC ] STREAM LISTENING 10270
/var/run/cups/cups.sock

-n : Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names.

matriux ~ # netstat -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:57087 209.85.153.83:80 ESTABLISHED
tcp 0 0 192.168.100.183:57085 209.85.153.83:80 TIME_WAIT
tcp 0 0 192.168.100.183:57090 209.85.153.83:80 ESTABLISHED
tcp 0 0 192.168.100.183:57089 209.85.153.83:80 ESTABLISHED
tcp 0 0 192.168.100.183:57081 209.85.153.83:80 TIME_WAIT
tcp 0 0 192.168.100.183:57082 209.85.153.83:80 TIME_WAIT
tcp 0 0 192.168.100.183:57086 209.85.153.83:80 ESTABLISHED
tcp 0 0 192.168.100.183:57080 209.85.153.83:80 TIME_WAIT
tcp 0 0 192.168.100.183:57088 209.85.153.83:80 ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644



-N : Displayes Symbolic resolve hardware names

matriux ~ # netstat -N
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:57090 209.85.153.83:http TIME_WAIT
tcp 0 0 192.168.100.183:57089 209.85.153.83:http TIME_WAIT
tcp 0 0 192.168.100.183:57086 209.85.153.83:http TIME_WAIT
tcp 0 0 192.168.100.183:57092 209.85.153.83:http TIME_WAIT
tcp 0 0 192.168.100.183:57088 209.85.153.83:http TIME_WAIT
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket

-o : Displays active TCP connections and includes the process ID (PID) for each connection. You can find the application based on the PID on the Processes tab in Windows Task Manager. This parameter can be combined with -a, -n, and -p. This parameter is available on Microsoft Windows XP, 2003 Server (and Windows 2000 if a hotfix is applied).

matriux ~ # netstat -o
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State Timer
tcp 0 0 192.168.100.183:42963 im-in-f83.google.c:http
TIME_WAIT timewait (48.46/0/0)
tcp 0 0 192.168.100.183:42967 im-in-f83.google.c:http
ESTABLISHED off (0.00/0/0)
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http
ESTABLISHED off (0.00/0/0)
tcp 0 0 192.168.100.183:42965 im-in-f83.google.c:http
TIME_WAIT timewait (10.56/0/0)
tcp 0 0 192.168.100.183:58607 im-in-f83.google.c:http
ESTABLISHED off (0.00/0/0)
tcp 0 0 192.168.100.183:42968 im-in-f83.google.c:http
TIME_WAIT timewait (11.75/0/0)
tcp 0 0 192.168.100.183:58608 im-in-f83.google.c:http
TIME_WAIT timewait (55.19/0/0)
tcp 0 0 192.168.100.183:42962 im-in-f83.google.c:http
ESTABLISHED off (0.00/0/0)
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 54936
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935
unix 3 [ ] STREAM CONNECTED 54934
/tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932
unix 3 [ ] STREAM CONNECTED 54699 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket
unix 3 [ ] STREAM CONNECTED 44847
unix 3 [ ] STREAM CONNECTED 44850
/tmp/ksocket-root/konquerorlmR3Hb.slave-socket
unix 3 [ ] STREAM CONNECTED 44834
unix 3 [ ] STREAM CONNECTED 44422 /tmp/.ICE-unix/5389
unix 3 [ ] STREAM CONNECTED 44421
unix 3 [ ] STREAM CONNECTED 44420 /tmp/.X11-unix/X0

-p Linux: Process : Show which processes are using which sockets (similar to -b under Windows) (you must be root to do this) on Windows: Protocol : Shows connections for the protocol specified by Protocol. In this case, the Protocol can be tcp, udp, tcpv6, or udpv6. If this parameter is used with -s to display statistics by protocol, Protocol can be tcp, udp, icmp, ip, tcpv6, udpv6, icmpv6, or ipv6.



matriux ~ # netstat -p
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State PID/Program name
tcp 0 0 192.168.100.183:42954 im-in-f83.google.c:http
ESTABLISHED 10246/klaunchericER
tcp 0 0 192.168.100.183:57095 im-in-f83.google.c:http
TIME_WAIT -
tcp 0 0 192.168.100.183:42955 im-in-f83.google.c:http
TIME_WAIT -
tcp 0 0 192.168.100.183:42957 im-in-f83.google.c:http
ESTABLISHED 10311/klaunchericER
tcp 0 0 192.168.100.183:42956 im-in-f83.google.c:http
ESTABLISHED 11776/klaunchericER
tcp 0 0 192.168.100.183:42958 im-in-f83.google.c:http
TIME_WAIT -
tcp 0 0 192.168.100.183:57094 im-in-f83.google.c:http
ESTABLISHED 10315/klaunchericER
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node PID/Program
name Path
unix 2 [ ] DGRAM 2445 3226/udevd
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936
4884/syslogd /dev/log
unix 3 [ ] STREAM CONNECTED 54936
5370/dcopserver [kd /tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 54935 11776/klaunchericER
unix 3 [ ] STREAM CONNECTED 54934
5499/konqueror [kde /tmp/ksocket-root/konquerorx0J3lb.slave-socket
unix 3 [ ] STREAM CONNECTED 54932 11776/klaunchericER
unix 3 [ ] STREAM CONNECTED 54699 5306/X
/tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 54698 5374/klauncher [kde
unix 3 [ ] STREAM CONNECTED 44869
5370/dcopserver [kd /tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868 10318/klaunchericER
unix 3 [ ] STREAM CONNECTED 44867
5499/konqueror [kde /tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864 10318/klaunchericER
unix 3 [ ] STREAM CONNECTED 44858
5370/dcopserver [kd /tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857 10315/klaunchericER

-r : Displays the contents of the IP routing table. (This is equivalent to the route print command under Windows.)

matriux ~ # netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.100.0 * 255.255.255.0 U 0 0 0 eth1
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.100.254 0.0.0.0 UG 0 0 0 eth1

-s : Displays statistics by protocol. By default, statistics are shown for the TCP, UDP, ICMP, and IP protocols. If the IPv6 protocol for Windows XP is installed, statistics are shown for the TCP over IPv6, UDP over IPv6, ICMPv6, and IPv6 protocols. The -p parameter can be used to specify a set of protocols.

matriux ~ # netstat -s
Ip:
4582 total packets received
9 with invalid addresses
0 forwarded
0 incoming packets discarded
4573 incoming packets delivered
2107 requests sent out
16 dropped because of missing route
Icmp:
9 ICMP messages received
3 input ICMP message failed.
ICMP input histogram:
echo requests: 3
echo replies: 6
4 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 1
echo request: 3
IcmpMsg:
InType0: 6
InType8: 3
OutType3: 1
OutType8: 3
Tcp:
142 active connections openings
0 passive connection openings
0 failed connection attempts
9 connection resets received
0 connections established
1783 segments received
1920 segments send out
0 segments retransmited
0 bad segments received.
2 resets sent
Udp:
183 packets received
1 packets to unknown port received.
0 packet receive errors
183 packets sent
UdpLite:
TcpExt:
112 TCP sockets finished time wait in fast timer
40 delayed acks sent
697 packets directly queued to recvmsg prequeue.
2866 bytes directly in process context from backlog
820028 bytes directly received in process context from prequeue
270 packet headers predicted
639 packets header predicted and directly queued to user
270 acknowledgments not containing data payload received
8 predicted acknowledgments
7 connections reset due to early user close
IpExt:
InBcastPkts: 2606
OutBcastPkts: 6

-v : When used in conjunction with -b it will display the sequence of components involved in creating the connection or listening port for all executables.

matriux ~ # netstat -v
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.100.183:57083 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:57085 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:57084 im-in-f83.google.c:http TIME_WAIT
tcp 0 0 192.168.100.183:57081 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:57082 im-in-f83.google.c:http ESTABLISHED
tcp 0 0 192.168.100.183:57080 im-in-f83.google.c:http ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 2445
@/org/kernel/udev/udevd
unix 5 [ ] DGRAM 9936 /dev/log
unix 3 [ ] STREAM CONNECTED 44869
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44868
unix 3 [ ] STREAM CONNECTED 44867
/tmp/ksocket-root/konquerorLlGFSa.slave-socket
unix 3 [ ] STREAM CONNECTED 44864
unix 3 [ ] STREAM CONNECTED 44858
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44857
unix 3 [ ] STREAM CONNECTED 44853
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44852
unix 3 [ ] STREAM CONNECTED 44851
/tmp/ksocket-root/konquerorm4BxBa.slave-socket
unix 3 [ ] STREAM CONNECTED 44847
unix 3 [ ] STREAM CONNECTED 44850
/tmp/ksocket-root/konquerorlmR3Hb.slave-socket
unix 3 [ ] STREAM CONNECTED 44834
unix 3 [ ] STREAM CONNECTED 44422 /tmp/.ICE-unix/5389
unix 3 [ ] STREAM CONNECTED 44421
unix 3 [ ] STREAM CONNECTED 44420 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 44417
unix 3 [ ] STREAM CONNECTED 44414
/tmp/.ICE-unix/dcop5370-1243447644
unix 3 [ ] STREAM CONNECTED 44413

Interval : Redisplays the selected information every Interval seconds. Press CTRL+C to stop the redisplay. If this parameter is omitted, netstat prints the selected information only once.

/? : Displays help at the command prompt. (only on Windows)



Netstat provides statistics for the following:

* Proto - The name of the protocol (TCP or UDP).

* Local Address - The IP address of the local computer and the port number being used. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*).

* Foreign Address - The IP address and port number of the remote computer to which the socket is connected. The names that corresponds to the IP address and the port are shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*).

* State - Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIME_WAIT. For more information about the states of a TCP connection, see.



Connection States

Indicates the state of a TCP connection. The possible states are as follows:

CLOSE_WAIT

CLOSED

ESTABLISHED

FIN_WAIT_1

FIN_WAIT_2

LAST_ACK

LISTEN

SYN_RECEIVED

SYN_SEND

TIMED_WAIT



· To display the statistics for only the TCP or UDP protocols, type one of the following commands:

netstat -s -p tcp

netstat -s -p udp

· To display active TCP connections and the process IDs every 5 seconds, type the following command (works on Microsoft XP and 2003 only, or Windows 2000 with hotfix):

netstat -o 5

· To display active TCP connections and the process IDs using numerical form, type the following command (works on Microsoft XP and 2003 only, or Windows 2000 with hotfix):

netstat -n -o


This Article can be found at the blog section of www.dileepk.info

Traceroute Explained

What is Traceroute

Traceroute is a computer network tool used to determine the route taken by packets across an IP network.

Traceroute is a tool available on all Unix variants, traceroute have many variants like tracepath ( Linux ), tracert ( windows), windows NT based system have another implementation named pathping does the similar job

How traceroute works

Traceroute works by increasing the "time-to-live" value of each successive batch of packets sent

Traceroute sending out a packet with a Time To Live (TTL) of 1. The first hop then sends back an ICMP [1] error message indicating that the packet could not be forwarded because the TTL expired. The packet is then resent with a TTL of 2, and the second hop returns the TTL expired. This process continues until the destination is reached. The purpose behind this is to record the source of each ICMP TTL exceeded message to provide a trace of the path the packet took to reach the destination.

When a packet passes through a host, normally the host decrements the TTL value by one, and forwards the packet to the next host. When a packet with a TTL of one reaches a host, the host discards the packet and sends an ICMP time exceeded (type 11) packet to the sender. The traceroute utility uses these returning packets to produce a list of hosts that the packets have traversed en route to the destination.

traceroute utility by default uses UDP datagrams with destination ports number range from 33434 to 33534

The traceroute utility usually has an option to specify use of ICMP echo request (type 8) as used by the Windows tracert utility

Why traceroute is using

Traceroute is often used for network troubleshooting. Providing a list of routers traversed, it allows the user to identify the path taken to reach a particular destination in the network. This can help identify routing problems or firewalls that may be blocking access to a site.

Traceriute is also used by penetration testers to get an idea about the network infrastructure and IP range.

Traceroute can help us in download data, if we have choices of mirrors, definitely we can find out which mirror gives the faster download

Traceroute IP option format

Following is the representation of Traceroute with IP option format

its	0-7			8-15	16- 31
Data Format	F	C	Number	Length	ID Number
	Outbound Hop Count				Return Hop Count
	Originator IP Address

F (copy to fragments) : - It uses 1 bit (1/8) this is set to 1 if the option is indented to copied in to all the fragments when a datagram is fragmented , it is set to 0 if it is not copied to fragments. It uses 1 bit

C (class) :- It uses 2 bits (2/8) specifies one of the four potential values that indicates the general category into which the option belongs. Normally only two of the values are used 0 and 2. 0 is for controlling option and 2 is for debugging and measurement. It uses 2 bits

Number :- it uses 5 bits (5/8) specifies the kind of option. 32 different values can be specified for each of the two option classes, of these only few are most commonly used. . It uses 5 bits

18 (F+C+Number = 82)

Amazed how we got the number 82, the steps as follows

((0<<7) | (2<<5) | 18) =82

Ie (0 X 2⁷)=0

(2 X 2⁵)=64

0 | 64 | 18 = 82

Hope now you got how we arrived at the number 82

Option Class	Option Number	Length (bytes)	Option Name	Description
0	0	1	End Of Options List	An option containing just a single zero byte, used to mark the end of a list of options.
0	1	1	No Operation	A “dummy option” used as “internal padding” to align certain options on a 32-bit boundary when required.
0	2	11	Security	An option provided for the military to indicate the security classification of IP datagrams.
0	3	Variable	Loose Source Route	One of two options for source routing of IP datagrams. See below for an explanation.
0	7	Variable	Record Route	This option allows the route used by a datagram to be recorded within the header for the datagram itself. If a source device sends a datagram with this option in it, each router that “handles” the datagram adds its IP address to this option. The recipient can then extract the list of IP addresses to see the route taken by the datagram.
0	9	Variable	Strict Source Route	One of two options for source routing of IP datagrams. See below for an explanation.
2	4	Variable	Timestamp	This option is similar to the Record Route option. However, instead of each device that handles the datagram inserting its IP address into the option, it puts in a timestamp, so the recipient can see how long it took for the datagram to travel between routers.
2	18	12	Traceroute	Used in the enhanced implementation of the traceroute utility, as described in RFC 1393.

ID Number

An arbitrary number used by the originator of the Outbound Packet to identify the ICMP Traceroute messages. It is NOT related to the ID number in the IP header. . It uses 16 bits

Originator IP Address

The IP address of the originator of the Outbound Packet. This is needed so the routers know where to send the ICMP Traceroute message for Return Packets. It is also needed for Outbound Packets which have a Source Route option. . It uses 16 bits

Outbound Hop Count (OHC)

The number of routers through which the Outbound Packet has passed. This field is not incremented by the Outbound Packet's destination. . It uses 16 bits

Return Hop Count (RHC)

The number of routers through which the Return Packet has passed. This field is not incremented by the Return Packet's destination. . It uses 32 bits

Traceroute ICMP option format

Following is the representation of Traceroute with ICMP message format

Bits	0-7	8-15		16- 31
Data Format	Type	Code		Checksum
	ID Number			Unused
	Outbound hope Count		Return Hop Count
	Output Link Speed
	Output link MTU

Type :- Always 30. It uses 8 bits

Code . It uses 8 bits

Code	Description
0	Outbound Packet successfully forwarded
1	No route for Outbound Packet; packet discarded

Checksum : - The 16 bit one's complement of the one's complement sum of all 16 bit words in the header. For computing the checksum, the checksum field should be zero. It uses 16 bits

ID Number:- The ID Number as copied from the IP Traceroute option of the packet which caused this Traceroute message to be sent. This is NOT related to the ID number in the IP header. It uses 16 bits

Unused: - It uses 16 bits

Outbound Hop Count:-The Outbound Hop Count as copied from the IP Traceroute option of the packet which caused this Traceroute message to be sent. It uses 16 bits

Return Hop Count:-The Return Hop Count as copied from the IP Traceroute option of the packet which caused this Traceroute message to be sent. It uses 16 bits

Output link speed : The speed, in bytes per second, of the link over which the Outbound/Return Packet will be sent. If this value cannot be determined, the field should be set to zero. It uses 32 bits

Output link MTU : The MTU (Maximum Transmission Unit), in bytes, of the link over which the Outbound/Return Packet will be sent. MTU refers to the data portion (includes IP header; excludes datalink header/trailer) of the packet. If this value cannot be determined, this field should be set to zero. It uses 32 bits

If a packet does not return within the expected timeout window, a star (asterisk) is traditionally printed

Traceroute command

The traceroute implementation is available on most of the operationg systems, including most Unix systems, Linux, Mac OS X, and Windows 95 and later.

On a Unix/Linux system, including Mac OS X, run a traceroute at the command line like this:

traceroute [servername]

Windows, the command is called tracert. Open a DOS window and enter the command:

tracert [servername]

Interpreting the output of traceroute

Here is some example traceroute output, from a Linux system: I have used the Linux distro named Matiux, the swiss army knife for a Hacker with loads of tools and applications by security expert Manu Zacharia , the distribution is yet to be realsed

matriux ~ # traceroute www.airnews.net

traceroute to tower-iaweb.mis.iadfw.net (209.44.184.153), 30 hops max, 38 byte packets

4 illekm-static-203.200.136.33.vsnl.net.in (203.200.136.33) 5.779 ms 3.932 ms 4.242 ms

5 if-1-1.core3.NQT-NewYork.as6453.net (64.86.5.5) 254.191 ms 260.088 ms 254.802 ms

6 if-14-0.mcore4.NQT-NewYork.as6453.net (216.6.87.45) 246.136 ms 245.748 ms 246.004 ms

7 if-5-0.mcore3.NYY-NewYork.as6453.net (216.6.87.54) 246.415 ms 246.365 ms 248.866 ms

8 if-2-0-0-976.mcore4.NYY-NewYork.as6453.net (216.6.81.6) 255.208 ms 253.232 ms 252.844 ms

9 if-5-0.mcore4.NJY-Newark.as6453.net (216.6.63.41) 259.878 ms 275.122 ms 261.457 ms

10 Vlan1101.icore1.NJY-Newark.as6453.net (216.6.63.6) 258.184 ms 254.848 ms 261.434 ms

11 ix-3-1.icore1.NJY-Newark.as6453.net (206.82.132.38) 262.131 ms 261.582 ms 260.846 ms

12 ded1-g8-3-0.hstntx.sbcglobal.net (151.164.241.101) 337.080 ms 313.352 ms 313.639 ms

13 Internet.cust-rtr.swbell.net (70.253.121.218) 317.513 ms 316.848 ms 316.081 ms

14 * * *

15 * * *

16 * * *

Here, I am tracing the route to airnews.net, the news server name at Airnews. The first line of output is information about what are we going to do; it shows the target system, that system's IP address, the maximum number of hops that will be allowed, and the size of the packets being sent.

Then we have one line for each system or router in the path between our system and the target system. Each line shows the name of the system (as determined from DNS), the system's IP address, and three round trip times in milliseconds. The round trip times (or RTTs) tell us how long it took a packet to get from our system to another system and back , called the latency between the two systems. By default, three packets are sent to each system along the route, so we get three RTTs.

Eg : 4 illekm-static-203.200.136.33.vsnl.net.in (203.200.136.33) 5.779 ms 3.932 ms 4.242 ms

Sometimes, a line in the output may have all times missing, with an asterisk where it should be: this means no packets returned

eg:- 14 * * *

If it comes like the following means we have lost two packets

eg: -5 if-1-1.core3.NQT-NewYork.as6453.net (64.86.5.5) 254.191 ms * *

In this case, the machine is up and responding, but for whatever reason it did not respond to the second and third packets. This does not necessarily indicate a problem; in fact, it is usually normal, and just means that the system discarded the packet for some reason. Many systems do this normally.

It's important to remember that timeouts are not necessarily an indication of packet loss. This is a common misconception, but since there are only three probes, dropping one response is no big deal.

Sometimes you will see an entry with just an IP address and no name:

eg: 12 151.164.241.101 (151.164.241.101) 337.080 ms 313.352 ms 313.639 ms

This simply means that a reverse DNS lookup on the address failed, so the name of the system could not be determined.

This means that the target system could not be reached. More accurately, it means that the packets could not make it there and back; they may actually be reaching the target system but encountering problems on the return trip. This can be possibly due to some problem, but it may also be an intentional block due to a firewall or other security measures, and the block may affect traceroute but not actual server connections.

Error Messages in Traceroute

A trace can end with one of several error indications indicating why the trace cannot proceed. In this example, the router is indicating that it has no route to the target host:

eg: - 14 if-5-0.mcore4.NJY-Newark.as6453.net (216.6.63.41) 35.931 ms !H * 39.970 ms !H

The !H is a “host unreachable” error message (it indicates that an ICMP error message was received). The trace will stop at this point. Possible ICMP error messages of this nature include:

!H :- Host unreachable. The router has no route to the target system.

!N :- Network unreachable.

!P :- Protocol unreachable.

!S :- Source route failed. You tried to use source routing, but the router is configured to block source-routed packets.

!F :- Fragmentation needed. This indicates that the router is misconfigured.

!X :- Communication administratively prohibited. The network administrator has blocked traceroute at this router.

with some versions of traceroute, you will see TTL warnings after the times:

eg: - 5 if-1-1.core3.NQT-NewYork.as6453.net (64.86.5.5) 90.0 ms (ttl=251!) 90.0 ms (ttl=251!) 90.0 ms (ttl=251!)

This merely indicates that the TTL (time-to-live) value on the reply packet was different from what was expected. This probably means that your route is asymmetric. This is not shown by all versions of traceroute, and can be safely ignored.

The output of the Windows version of traceroute is slightly different from the Unix

C:\>tracert www.airnews.net

Tracing route to tower-iaweb.mis.iadfw.net [209.44.184.153] over a maximum of 30 hops:

4 8 ms 6 ms 4 ms illekm-static-203.200.136.33.vsnl.net.in [203.200.136.33]

5 252 ms 252 ms 251 ms if-2-11.mse1.NW8-NewYork.as6453.net [209.58.75.37]

6 272 ms 256 ms 249 ms if-7-0-0.core1.NTO-NewYork.as6453.net [216.6.82.61]

7 256 ms 258 ms 251 ms Vlan14.icore1.NTO-NewYork.as6453.net [216.6.82.2]

8 256 ms 267 ms * Vlan7.icore1.NJY-Newark.as6453.net [206.82.132.13]

9 259 ms 261 ms 271 ms ix-3-1.icore1.NJY-Newark.as6453.net [206.82.132.38]

10 319 ms 318 ms 321 ms ded1-g8-3-0.hstntx.sbcglobal.net [151.164.241.101]

11 320 ms 320 ms 325 ms Internet.cust-rtr.swbell.net [70.253.121.218]

12 324 ms 319 ms 341 ms tower.mis.iadfw.net [209.44.184.150]

13 320 ms 324 ms 318 ms tower-iaweb.mis.iadfw.net [209.44.184.153]

Trace complete.

The Windows version does not show ICMP error messages as we described above. Errors are shown as (possibly ambiguous or confusing) text. For example, a “host unreachable” error will be shown as “Destination net unreachable” on Windows.

Reverse route

All the connections over the Internet actually depends on two routes. The route from our system to the server and the route from that server back to our system. These routes most probably completely different (asymmetric). If they differ, there is a problem in our connection and it could be a problem with either the route to the server, or with the route back from the server. So a traceroute result gives half of the picture

Unfortunately, source routing has a great potential for abuse, and therefore most network administrators block all source-routed packets at their border routers. In reality, loose source routes (specifies a system your packets should pass through before proceeding on to their destination) are not going to work.

Timeouts

See the results below

12 ded1-g8-3-0.hstntx.sbcglobal.net (151.164.241.101) 337.080 ms 313.352 ms 313.639 ms

13 Internet.cust-rtr.swbell.net (70.253.121.218) 317.513 ms 316.848 ms 316.081 ms

14 * * *

15 * * *

Well, obviously, if the trace stops at a particular system and can't go any further, then that system is where the problem lies, right? Yes there is a possibility but not necessarily because it may be blocked intentionally.

Long Routes

If our route to the destination server is very long, its going to impact on the. The reasons for a long route can be because of less-than-optimal configuration within some network .

High latency

As we discussed earlier the three numbers given on each line of traceroute output show the round trip times (latency) in milliseconds. Smaller numbers generally mean better connections. As the latency of a connection increases, performance degrades. Download speed can also suffer as a result of high latency (due to TCP windowing)

eg: - 4 illekm-static-203.200.136.33.vsnl.net.in (203.200.136.33) 5.779 ms 3.932 ms 4.242 ms

5 if-1-1.core3.NQT-NewYork.as6453.net (64.86.5.5) 254.191 ms 260.088 ms 254.802 ms

6 if-14-0.mcore4.NQT-NewYork.as6453.net (216.6.87.45) 246.136 ms 245.748 ms 246.004 ms

This example we have a high latency but it is because of cross-country link and it is natural.

If we observe, in a trace output, a large “jump” in latency from one hop to the next, that could indicate a problem. It could be a saturated (overused) network link; a slow network link; an overloaded router; or some other problem at that hop. Of course, it could also be a problem with the return route. If we feel like a roblem in the network, we can use the ping program (to get a better idea of the latency as well as the packet loss to a given site or router; traceroute only does three probes per router (by default)

Routing Weirdness

Routing weirdness, it can be showing the private ip address on the traceroute output. Following ip ranges are private and it is not supposed to show over internet routing.

The reserved private address ranges are:

* 10.*

* 172.[16-31].*

* 192.168.*

These ip address can be shown in our private network or intranet, exposing these ip over the internet will definitely cause problems.

A trace which includes private addresses is difficult to troubleshoot. we can't ping the private routers to see if there is any packet loss. We can't trace directly to them from other sites. That means, they show a certain level of cluelessness in how the network is set up

Routing loop

There is a chance we get a trace result as a route start “looping” back and forth between two routers, until the 30-hop limit is reached. This is called as routing loop. This usually means that one router has lost communication with another, and thus has dropped that route. Since the router has lost the route it needs, it sends the packet back to the sender, thinking maybe that is the best route. That router knows better and sends it back to the other one, over and over and it causes a loop.

This article can be found at the blog section of www.dileepk.info