[atlas] traceroute measurement with abnormally small RTT

Hi,

On 2017/01/18 18:01 , Wenqin SHAO wrote:
> It’s a IPv4 traceroute measurement toward DNS b root, 192.228.79.201.
> What you’ll see is:
> starting from hop 14, the 3 measurements for the same hop come from
> different IP address:
> 
>     hop 14: 184.105.80.202, 72.52.92.122
>     hop 15: 72.52.92.122, 216.218.223.28
>     hop 16: 216.218.223.28, 130.152.181.189
>     hop 17: 130.152.181.189, 206.117.5.22
>     hop 18: 206.117.5.22, 192.228.79.201
>     hop 19: 192.228.79.201
> 
> 
> My first doubt is with Paris traceroute is it still possible that
> response IP can change due to LB mechanism on the returning path?

Obviously, middle boxes can do anything including changing IP addresses
in packets. However, normally you see one the addresses of the router
that generated the error ICMP there and the actual return path only
affects rtt and ttl.

> At hop 18, the traceroute actually already reached the destination, but
> it continued to perform the hop 19, why?

Traceroute continues if a hop generates a TTL exceeded. For a UDP
traceroute the expected value is a UDP port unreachable.

Sometimes a middle box in front of the destination sends a TTL exceed
when you expect the target to handle the packet.

> At hop 19, there is one measurement from 192.228.79.201 reporting
> abnormally small RTT of 0.449ms. How come? Can that happen to other
> measurements as well, under what circumstances?
> 
> The above listed neighbouring hops always share one IP address, which
> makes it seem like a data formatting issue. Is there a known bug?

There is something really weird going on here. I have no idea what is
causing this.

Philip