Spectroscopy of traceroute delays

Abstract

We analyze delays of traceroute probes, i.e. packets that elicit ICMP TimeExceeded messages, for a full range of probe sizes up to 9000 bytes as observed on unloaded high-end routers. Our ultimate motivation is to use traceroute RTTs for Internet mapping of router and PoP (ISP point-of-presence) level nodes, including potentially gleaning information on equipment models, link technologies, capacities, latencies, and spatial positions. To our knowledge it is the first study to examine in a reliable testbed setting the detailed statistics of ICMP response generation. We find that two fundamental assumptions about ICMP often do not hold in modern routers, namely that ICMP delays are a linear function of packet size and that ICMP generation rate is equal to the capacity of the inteface on which probes are received. The primary causes of these violations appear to be optimizations that suppress size dependence, e.g. buffer carving, and rate-limiting of internal ICMP packet and bit rates. Our results suggest that the linear model of packet delay as a function of packet size merits revisiting for many situations, especially for packets over 1500 bytes. Our findings also suggest possibilities of developing new techniques for bandwidth estimation and router fingerprinting. © Springer-Verlag Berlin Heidelberg 2005.