BACKGROUND

Traceroute is a well-known network diagnostic tool used to track in real-time the pathway taken by a packet (referred to as a traceroute probe) on an Internet protocol (IP) network from source to destination and report the IP addresses of all network devices encountered in between. Traceroute records the time taken for each hop the probe makes during its route to the destination. Traceroute can be used to diagnose causes of response delays and routing loops present in a network pathway, and to identify points of failure between source and destination.

The traceroute utility is typically based on Internet Control Message Protocol (ICMP) echo packets or user datagram protocol (UDP) packets, with variable time to live (TTL) values. The response time of each hop is calculated. Traceroute uses ICMP error messages and TTL fields in the IP address header to function. Traceroute is typically included as a utility with operating systems (OS's) such as the Windows® OS and the Unix® OS.

SUMMARY

In accordance with the present disclosure, a network device can gather information about other network devices along a path between a sending computer and a receiving computer. Processing can include the network device receiving a stream of ingress packets from the sending computer. The network device can identify a traceroute probe in the stream of ingress packets using a filter that matches for a first time-to-live (TTL) value in the stream of ingress packets. The traceroute probe can be encapsulated in an egress packet including: decrementing an inner TTL value of the traceroute probe; determining an outer TTL value of the egress packet based on the decremented inner TTL value; and adjusting the decremented inner TTL value by an amount based on a hops counter that indicates a number of network devices along a segment of the path between the sending computer and the receiving computer. The network device can forward, the egress packet and update the filter to match for a second TTL value in the stream of ingress packets to identify a subsequent traceroute probe in the stream of ingress packets.

The filter can match for a flow signature that indicates the sending computer, in addition to matching the first TTL value, to identify the traceroute probe. The network device can detect an initial traceroute probe of a traceroute session and extract the flow signature from the initial traceroute probe, wherein the flow signature identifies subsequent traceroute probes in the traceroute session. The filter can include a rule that comprises a match criterion that matches for a TTL value of ‘1’ in the stream of ingress packets to identify the initial traceroute probe.

The network device can update the filter by adding a rule to the filter to match for the second TTL value.

The network device can receive a time exceeded message from an upstream device and in response the network device incrementing the hops counter by one. The network device can increment the hops counter by one only when the network device is the destination of the time exceeded message.

The network device can receive a time exceeded message from an upstream device that is destined for the network device, and in response generate a new time exceeded message using address information contained in the received time exceeded message and transmitting the new time exceeded message to the sending computer.

The network devices along the segment of the path between the sending computer and the receiving computer can be routers.

The filter can include a rule to match for an ingress packet having both an outer TTL and an inner TTL value of ‘1’, and in response to the rule matching a received ingress packet from a sending network device, transmit a time exceeded message: to the sending network device when an inner destination media access control (DMAC) address in the received ingress packet is not the same as a MAC address of the network device; and to the sending computer when the inner DMAC in the received ingress packet is the same as the MAC address of the network device.

