5

I'm doing a traceroute from my box to ....say.... stackoverflow.com. I see a couple of instances where there are multiple ip's on one line. For instance, in below, line #2 has two IPs: 10.1.6.5 and 10.1.4.5

Also on line #4, there are two timestamps after 216.182.236.96: 0.653 ms and 0.637 ms

What are these? This is on Linux

Traceroute example:

traceroute to www.stackoverflow.com (198.252.206.16), 30 hops max, 60 byte packets
 2  ip-10-1-6-5.us-west-1.compute.internal (10.1.6.5)  0.329 ms  0.425 ms ip-10-1-4-5.us-west-1.compute.internal (10.1.4.5)  0.471 ms
 4  216.182.236.104 (216.182.236.104)  0.554 ms 216.182.236.96 (216.182.236.96)  0.653 ms  0.637 ms
 5  205.251.230.64 (205.251.230.64)  0.616 ms 205.251.229.232 (205.251.229.232)  1.305 ms 205.251.230.64 (205.251.230.64)  0.573 ms
Improve this question

2 Answers 2

Reset to default
2

You will typically see this when there is some form of load balancing and/or multiple next hops from that specific routers perspective. For example, where I am working right now. It's a traceroute from a Cisco Catalyst 6505. I know I have 3 paths to this network. Notice the 3 IPs correspond to the next hops from the "show ip route" command.

router_name#traceroute 1.1.1.1 numeric 
Type escape sequence to abort.
Tracing the route to 1.1.1.1
  1 10.32.0.21 0 msec
    172.20.35.3 0 msec
    10.26.32.2 0 msec
<SNIP> -- everything after here is irrelevant.

!
!
router_name#show ip ro 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "eigrp 1", distance 170, metric 171008
<SNIP>
  Routing Descriptor Blocks:
    172.20.35.3, from 172.20.35.3, 3w5d ago, via Vlan35
<SNIP>
    10.32.0.21, from 10.32.0.21, 3w5d ago, via Vlan1
<SNIP>
  * 10.26.32.2, from 10.26.32.2, 3w5d ago, via Vlan32
<SNIP>
Improve this answer
0

It looks like just internal redirecting. High flows of traffic can be dealt with redundancy, and you might be seeing a server set up for just that.

But being curious I ran the same thing (from Terminal in OSX):

    traceroute to stackoverflow.com (198.252.206.16), 64 hops max, 52 byte packets

--Deleted Personal Gateways--

 3  isu-uni.tele.iastate.edu (192.245.179.245)  9.002 ms  8.755 ms  8.894 ms
 4  ks-96-xe-1-0-3-211.greatplains.net (164.113.232.225)  13.200 ms  14.984 ms  13.327 ms
 5  xe-0-0-0.493.dlls0.tr-cps.internet2.edu (64.57.29.201)  23.383 ms  22.945 ms  22.851 ms
 6  * * *
 7  xe-1-1-0.cr1.dfw2.us.above.net (64.125.26.209)  32.932 ms  32.373 ms  31.367 ms
 8  xe-0-0-0.cr2.dfw2.us.above.net (64.125.30.74)  26.124 ms  27.908 ms  25.638 ms
 9  xe-4-2-0.cr2.iah1.us.above.net (64.125.31.122)  31.427 ms  94.282 ms  31.148 ms
10  xe-2-1-0.cr2.dca2.us.above.net (64.125.28.49)  46.684 ms  46.117 ms  46.603 ms
11  xe-3-2-0.cr2.lga5.us.above.net (64.125.26.110)  48.294 ms  47.685 ms  47.789 ms
12  xe-0-0-1.er4.lga5.us.above.net (64.125.24.169)  113.409 ms  47.644 ms  47.694 ms
13  208.184.110.78.ipyx-072053-004-zyo.above.net (208.184.110.78)  47.321 ms  47.109 ms  46.165 ms
14  border1.po1-20g-bbnet1.nym008.pnap.net (216.52.95.1)  47.225 ms  143.151 ms  439.687 ms
15  stackexchange-1.border1.nym008.pnap.net (74.201.252.22)  47.022 ms  46.337 ms  46.366 ms
16  stackoverflow.com (198.252.206.16)  46.885 ms  46.601 ms  46.386 ms

I am inclined to think that since you are routing through US West and you only show a the first few hits, if this is something that you see regularly, blame the routing service for having duplicates. If you are still seeing doubles later in your route, it might be something else.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .