While performing a traceroute, the transit and the last hop was not seen on the traceroute. However, the trace was completed.
> Simple representation of the topology –
Switch 1 >> Switch 2 >> Switch 3
> Enabling interface monitoring on the same switch, we can six packets in the ingress direction, with three from each of two switches. These included "ICMP time exceeded in-transit" messages from the transit switch and "UDP port **** unreachable" messages from the last switch.
> This behaviour was not seen in the customer’s setup .
root@Switch1> monitor traffic interface irb.11 no-resolve matching "icmp or udp" verbose output suppressed, use <detail> or <extensive> for full protocol decode Address resolution is OFF. Listening on irb.11, capture size 96 bytes 14:03:33.480775 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33434: UDP, length 24 14:03:33.491504 In IP 10.248.x.80 > 49.205.xx.200: ICMP time exceeded in-transit, length 36 14:03:34.906421 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33435: UDP, length 24 14:03:34.922204 In IP 10.248.x.80 > 49.205.xx.200: ICMP time exceeded in-transit, length 36 14:03:34.922544 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33436: UDP, length 24 14:03:34.938700 In IP 10.248.x.80 > 49.205.xx.200: ICMP time exceeded in-transit, length 36 14:03:34.939005 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33437: UDP, length 24 14:03:34.955182 In IP 100.67.x.13 > 49.205.72.200: ICMP 100.67.x.13 udp port 33437 unreachable, length 36 14:03:34.956538 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33438: UDP, length 24 14:03:34.971766 In IP 100.67.x.13 > 49.205.xx.200: ICMP 100.67.x.13 udp port 33438 unreachable, length 36 14:03:34.972069 Out IP truncated-ip - 14 bytes missing! 49.205.xx.200.60540 > 100.67.x.13.33439: UDP, length 24 14:03:34.988294 In IP 100.67.x.13 > 49.205.xx.200: ICMP 100.67.x.13 udp port 33439 unreachable, length 36
> ** In the lab setup** On the transit switch “Switch 2,” packets were received and sent on irb interface, a behaviour absent in the customer’s setup.
root@Switch2# ...e irb.11 no-resolve matching "icmp or udp" verbose output suppressed, use <detail> or <extensive> for full protocol decode Address resolution is OFF. Listening on irb.11, capture size 96 bytes 14:03:33.487523 In IP 49.205.xx.200.60540 > 100.67.x.13.33434: UDP, length 24 14:03:33.487621 Out IP truncated-ip - 18 bytes missing! 10.248.5.80 > 49.205.xx.200: [|icmp] 14:03:34.917178 In IP 49.205.xx.200.60540 > 100.67.x.13.33435: UDP, length 24 14:03:34.917272 Out IP truncated-ip - 18 bytes missing! 10.248.5.80 > 49.205.xx.200: [|icmp] 14:03:34.933561 In IP 49.205.xx.200.60540 > 100.67.x.13.33436: UDP, length 24 14:03:34.933643 Out IP truncated-ip - 18 bytes missing! 10.248.5.80 > 49.205.xx.200: [|icmp]
> Responses from the last node are as follows:
root@Switch3> ...solve matching "icmp or udp" verbose output suppressed, use <detail> or <extensive> for full protocol decode Address resolution is OFF. Listening on ae12, capture size 96 bytes 14:03:34.954856 In IP 49.205.x.200.60540 > 100.67.x.13.33437: UDP, length 24 14:03:34.954881 Out IP 100.67.x.13 > 49.205.x.200: ICMP 100.67.x.13 udp port 33437 unreachable, length 36 14:03:34.971347 In IP 49.205.x.200.60540 > 100.67.x.13.33438: UDP, length 24 14:03:34.971367 Out IP 100.67.x.13 > 49.205.x.200: ICMP 100.67.x.13 udp port 33438 unreachable, length 36 14:03:34.987828 In IP 49.205.x.200.60540 > 100.67.x.13.33439: UDP, length 24 14:03:34.987849 Out IP 100.67.x.13 > 49.205.x.200: ICMP 100.67.x.13 udp port 33439 unreachable, length 36
> In summary, we should see a response with “exceeded in-transit” from the transit switches and “udp port XXX unreachable” from the last node.
> It is required, for the customer to ensure there is return path from individual nodes for each node to be visible on the trace.
2024-11-21 : Article Created
2026-10-29: Updated and externalized.