Time Exceeded ICMP Message

The ICMP Time Exceeded message notifies a host when a packet it sent has been discarded because it was "out of time." Packets are not actually timed, but to prevent packets from being forwarded forever when there is a routing loop, each IP packet header includes a Time to Live (TTL) field. Routers decrement TTL by 1 every time they forward a packet; if a router happens to decrement TTL of a packet to 0, the router discards the packet and sends an ICMP Time Exceeded message to the sender of the original packet.

The Cisco IOS trace command uses the Time Exceeded message and the IP TTL field to its advantage. The trace command sends three packets, each with TTL set to 1, resulting in an ICMP Time Exceeded message being returned by the first router in the route (because that router decrements TTL to 0, discards the packet, and returns a Time Exceeded message). The trace command then sends another three packets with a TTL of 2, then another set with a TTL of 3, and so on, until it gets a response from the host. Example 5-1 shows this trace command on RouterA from Figure 5-1, with debug messages from RouterB listing the Time Exceeded messages sent from RouterB back to RouterA.

Example 5-1 ICMP debug on RouterB, When Running trace Command on RouterA RouterA# trace 10.1.2.14

Type escape sequence to abort. Tracing the route to 10.1.2.14

2 10.1.2.14 12 msec 8 msec 4 msec RouterA#

RouterB#

ICMP: time exceeded (time to live) sent to 10.1.3.251 (dest was 10.1.2.14)

ICMP: time exceeded (time to live) sent to 10.1.3.251 (dest was 10.1.2.14)

ICMP: time exceeded (time to live) sent to 10.1.3.251 (dest was 10.1.2.14)

Was this article helpful?

+4 -1

Post a comment