Traceroute Anomalies

Traceroute is – after ping – one of the most widely used network diagnostic tools, due to its simplicity and yet very wide range of applications. Possible applications for traceroute range from simple error diagnosis to large scans, which reveal the underlying network topology. However, since traceroute was not built with modern network technologies in mind, it faces many di culties. These di culties usually manifest themselves in strange or false results, so-called anomalies. This drastically a↵ects traceroute’s abilities for network diagnosis and analyzation, especially in large-scale networks. The correct use of traceroute and interpretation of its output has therefore become more and more important. Projects trying to map the topology of the Internet are also greatly a↵ected by traceroute anomalies, as they usually have to solely rely on traceroute and similar scans. This paper gives a systematic overview of the most frequent traceroute anomalies. The main symptoms of each anomaly are examined based on example scenarios and corresponding output. Additionally, the consequences each anomaly has on the diagnosis of network failures, congestion and mapping e↵orts is analyzed. This also includes typical wrong conclusions drawn from anomalous traceroute results. Finally, several existing and promising future countermeasures against the respective anomalies are presented and analyzed.