6 ms·

> I realized I had never seen this sort of thing on the web before. Search for: "looking glass bgp" and you'll find some[1]. One of the first CGI programs I wr

by js2 3y ago

> I realized I had never seen this sort of thing on the web before. Search for: "looking glass bgp" and you'll find some[1]. One of the first CGI programs I wrote nearly three decades ago (ugh...) was a Perl script that wrapped traceroute and streamed the results via server push[2]. Everything old is new again. :-) That said, your site has a very nice presentation. BTW, ipv4 TTL is dejure seconds even though it's defacto hop count since no router takes more than a second and the minimum decrement is 1 (except middleboxes which wish to remain hidden won't decrement at all). Also, Linux/Unix traceroute by default use UDP to a high numbered (and usually closed) port for probe packets instead since UDP historically is less likely to be dropped/filtered than ICMP. Aside: asking how traceroute works is one of my interview questions, most people don't know (if they do the question is no good) and many are unable to figure it out from first principles no matter how many questions I answer about TCP/IP. I still think being able to figure it out is a reasonable problem solving question. 1. e.g. https://www.bgplookingglass.com/ https://www.bgplookingglass.com/ 2. https://www.oreilly.com/openbook/cgi/ch06_06.html https://www.oreilly.com/openbook/cgi/ch06_06.html

emmelaich 3y ago
Is that still true? https://www.rfc-editor.org/rfc/rfc3443.txt https://www.rfc-editor.org/rfc/rfc3443.txt has no mention of seconds. It just says that outputTTL is (inputTTL - 1). With some exceptions. [edit: I missed that that RFC is for MPLS but would be interested in your comment anyway; the definitive version seems to be https://datatracker.ietf.org/doc/html/rfc1122 https://datatracker.ietf.org/doc/html/rfc1122]
- js2 3y ago
  RFC 791: > The time is measured in units of seconds, but since every module that processes a datagram must decrease the TTL by at least one even if it process the datagram in less than a second, the TTL must be thought of only as an upper bound on the time a datagram may exist. https://www.rfc-editor.org/rfc/rfc791.html https://www.rfc-editor.org/rfc/rfc791.html The equivalent field in IPv6 is named hop limit in recognition of how the TTL field is used in practice with IPv4: https://www.rfc-editor.org/rfc/rfc2460.html https://www.rfc-editor.org/rfc/rfc2460.html
archmaster 3y ago
BGP looking glasses are very fun, although a bit of a different concept. And WOAH, that's really interesting about TTLs. Thanks for sharing! That's awesome and terrifying!
- js2 3y ago
  The looking glass sites often include a traceroute tool too, but "looking glass traceroute" may return better results. Unfortunately most of them have bitrotted. :-(
0x0000000 3y ago
> Aside: asking how traceroute works is one of my interview questions, most people don't know... Curious what type of roles you interview for, are they networking-centric? Iirc this is CCNA-level material, I'd expect anyone working in networking to be able to describe how traceroute works. I've used it more as a smoke test question than a question that most people don't know.
- js2 3y ago
  Unix sys admin, build & release, developer tooling, operations. We use the Internet every day. I like folks to have an idea how it works, to be intellectually curious, and to be generally informed about the technology they use. The traceroute man page explains how it works. FWIW, my CS degree included a networking class.
  - sterlind 3y ago
    fwiw, networking wasn't a required class at my school. neither was databases, weirdly, nor anything web-adjacent (no JS, no HTML or CSS.) ...huh. I'm realizing my CS department was pretty weak. but tbf I knew how traceroute worked by high school, so it didn't matter.
- Hikikomori 3y ago
  Describing how it works and using it to troubleshoot real problems and drawing the correct conclusions are very different things. If you believe it is simple then you have a shallow understanding of traceroute, which is why it's a good interview question as you can go really deep on your answer. Even seasoned network engineers get it wrong. https://youtu.be/WL0ZTcfSvB4?si=dtihJG1pGJwiyj1u https://youtu.be/WL0ZTcfSvB4?si=dtihJG1pGJwiyj1u
  - bwann 3y ago
    +1 for this, I always recommend ras' tutorials at NANOG. He goes into a lot of detail people just hand wave over or don't even consider
deathanatos 3y ago
> ipv4 TTL is dejure seconds Huh. TIL. But how would a router know how long a packet took to traverse the hop? The packet doesn't have the information to figure that out … were they expecting people to configure routers to know how far away the previous hop was? Also >1 second is most of the way to moon. (Yes, yes, speed in a non-vacuum is blah blah and switches blah buffers blah…)
- js2 3y ago
  Here's what Jon Postel wrote in IEN 41[1] in June 1978: > The time to live is set by the sender to the maximum time the segment is allowed to be in the internetwork system. If the segment is in the internetwork system longer than that the segment should be destroyed. This field should be decreased at each point that the internet header [is] processed to reflect the time spent processing the segment. Even if no local information is available on the time actually spent, the field should be decremented. The time is measured in units of seconds (i.e. the value 1 means one second). Thus the maximum time to live is 255 seconds or 4.25 minutes. A router would have to track of when each packet enters and leaves and then round to the nearest number of seconds. [1]: https://www.rfc-editor.org/ien/ien41.pdf https://www.rfc-editor.org/ien/ien41.pdf
hiAndrewQuinn 3y ago
> Also, Linux/Unix traceroute by default use UDP to a high numbered (and usually closed) port for probe packets instead since UDP historically is less likely to be dropped/filtered than ICMP. thanks! ive been wondering about this for ages!
- bwann 3y ago
  Trivia: 32,768 + 666 is the usual starting port of most implementations
gumby 3y ago
> many are unable to figure it out from first principles no matter how many questions I answer about TCP/IP TBF it's neither TCP nor IP, but ICMP :-) Edit: I meant to write "neither TCP nor UDP" -- but even though I could make the correction I'll leave my error in place.
- js2 3y ago
  It's IP and ICMP and possibly UDP, which are all part of TCP/IP, aka the Internet protocol suite.
  - geraldcombs 3y ago
    The traceroute that ships with macOS supports ICMP, UDP, TCP, and GRE. As I recall, the one(s) available on most Linux distributions do as well.

by js2 3y ago

emmelaich 3y ago

Is that still true? https://www.rfc-editor.org/rfc/rfc3443.txt https://www.rfc-editor.org/rfc/rfc3443.txt has no mention of seconds. It just says that outputTTL is (inputTTL - 1). With some exceptions. [edit: I missed that that RFC is for MPLS but would be interested in your comment anyway; the definitive version seems to be https://datatracker.ietf.org/doc/html/rfc1122 https://datatracker.ietf.org/doc/html/rfc1122]

js2 3y ago
RFC 791: > The time is measured in units of seconds, but since every module that processes a datagram must decrease the TTL by at least one even if it process the datagram in less than a second, the TTL must be thought of only as an upper bound on the time a datagram may exist. https://www.rfc-editor.org/rfc/rfc791.html https://www.rfc-editor.org/rfc/rfc791.html The equivalent field in IPv6 is named hop limit in recognition of how the TTL field is used in practice with IPv4: https://www.rfc-editor.org/rfc/rfc2460.html https://www.rfc-editor.org/rfc/rfc2460.html

archmaster 3y ago

BGP looking glasses are very fun, although a bit of a different concept. And WOAH, that's really interesting about TTLs. Thanks for sharing! That's awesome and terrifying!

js2 3y ago
The looking glass sites often include a traceroute tool too, but "looking glass traceroute" may return better results. Unfortunately most of them have bitrotted. :-(

0x0000000 3y ago

> Aside: asking how traceroute works is one of my interview questions, most people don't know... Curious what type of roles you interview for, are they networking-centric? Iirc this is CCNA-level material, I'd expect anyone working in networking to be able to describe how traceroute works. I've used it more as a smoke test question than a question that most people don't know.

js2 3y ago
Unix sys admin, build & release, developer tooling, operations. We use the Internet every day. I like folks to have an idea how it works, to be intellectually curious, and to be generally informed about the technology they use. The traceroute man page explains how it works. FWIW, my CS degree included a networking class.
- sterlind 3y ago
  fwiw, networking wasn't a required class at my school. neither was databases, weirdly, nor anything web-adjacent (no JS, no HTML or CSS.) ...huh. I'm realizing my CS department was pretty weak. but tbf I knew how traceroute worked by high school, so it didn't matter.
Hikikomori 3y ago
Describing how it works and using it to troubleshoot real problems and drawing the correct conclusions are very different things. If you believe it is simple then you have a shallow understanding of traceroute, which is why it's a good interview question as you can go really deep on your answer. Even seasoned network engineers get it wrong. https://youtu.be/WL0ZTcfSvB4?si=dtihJG1pGJwiyj1u https://youtu.be/WL0ZTcfSvB4?si=dtihJG1pGJwiyj1u
- bwann 3y ago
  +1 for this, I always recommend ras' tutorials at NANOG. He goes into a lot of detail people just hand wave over or don't even consider

deathanatos 3y ago

> ipv4 TTL is dejure seconds Huh. TIL. But how would a router know how long a packet took to traverse the hop? The packet doesn't have the information to figure that out … were they expecting people to configure routers to know how far away the previous hop was? Also >1 second is most of the way to moon. (Yes, yes, speed in a non-vacuum is blah blah and switches blah buffers blah…)

js2 3y ago
Here's what Jon Postel wrote in IEN 41[1] in June 1978: > The time to live is set by the sender to the maximum time the segment is allowed to be in the internetwork system. If the segment is in the internetwork system longer than that the segment should be destroyed. This field should be decreased at each point that the internet header [is] processed to reflect the time spent processing the segment. Even if no local information is available on the time actually spent, the field should be decremented. The time is measured in units of seconds (i.e. the value 1 means one second). Thus the maximum time to live is 255 seconds or 4.25 minutes. A router would have to track of when each packet enters and leaves and then round to the nearest number of seconds. [1]: https://www.rfc-editor.org/ien/ien41.pdf https://www.rfc-editor.org/ien/ien41.pdf

hiAndrewQuinn 3y ago

> Also, Linux/Unix traceroute by default use UDP to a high numbered (and usually closed) port for probe packets instead since UDP historically is less likely to be dropped/filtered than ICMP. thanks! ive been wondering about this for ages!

bwann 3y ago
Trivia: 32,768 + 666 is the usual starting port of most implementations

gumby 3y ago

> many are unable to figure it out from first principles no matter how many questions I answer about TCP/IP TBF it's neither TCP nor IP, but ICMP :-) Edit: I meant to write "neither TCP nor UDP" -- but even though I could make the correction I'll leave my error in place.

js2 3y ago
It's IP and ICMP and possibly UDP, which are all part of TCP/IP, aka the Internet protocol suite.
- geraldcombs 3y ago
  The traceroute that ships with macOS supports ICMP, UDP, TCP, and GRE. As I recall, the one(s) available on most Linux distributions do as well.