wikiLinux Network Analysis with mtr
The network diagnosis tool mtr (My Traceroute) combines the functionality of the tools traceroute and ping in an individual program. It can be used as text-based ncurses program or as graphical GTK+ program. mtr has been developed by BitWizard B.V., which is a Dutch company.
Function
The program is called up on the command line together with a host as parameter. For the "Host" field, enter the hostname or IP address to which you want to test the connection from the current computer:
mtr www.google.com
After the DNS trigger, mtr sends multiple ICMP echo requests (Pings) to the resolved IP address. However, the TTL (Time to live) is limited in the IP package. The first ICMP echo request only has a TTL of 1. The next request has a TTL of 2 and so on. Due to this limited TTL, the IP packet is discarded at the first, second, etc., hop (router). The router in question then responds with an ICMP "Time-to-live exceeded" message. As a result, mtr receives such a message from each router and thus knows which routers are along the path to the host.
After the TTL has been increased until the host is finally reached, mtr starts over from the beginning. Over time, mtr then calculates average values, best-case values, and worst-case values.
Installation
mtr is already included with most Linux distributions. It can be installed via the respective package management with the following package names:
- Red Hat/CentOS/Fedora/SuSE: mtr (text version), mtr-gtk (graphical version)
- Debian/Ubuntu: mtr-tiny (text version), mtr (text version and graphical version)
Example
The following examples show some mtr requests. The first three hops, however, have been anonymized.
Interactive output
The following output shows the mtr command being run. On Debian/Ubuntu, the parameter -t is required for the console version if the package mtr is installed (and not mtr-tiny):
mtr www.google.com
My traceroute [v0.80]
tpw (0.0.0.0) Wed Dec 18 09:24:14 2013
Keys: Help Display mode Restart statistics Order of fields quit
Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. dsldevice.lan 0.0% 24 68.4 66.2 4.8 100.6 23.8
2. XXXXX(Provider)XXXXX.at 0.0% 24 19.8 20.6 19.1 29.6 2.5
3. 195.3.66.157 0.0% 24 19.7 21.2 19.0 51.4 6.7
4. 195.3.68.1 0.0% 24 22.3 25.5 21.8 42.3 6.3
5. 195.3.70.154 0.0% 24 22.3 25.6 22.0 51.1 8.3
6. 62.47.120.150 0.0% 24 26.3 27.4 26.1 38.6 2.9
7. 209.85.243.119 0.0% 24 26.9 26.8 26.3 27.5 0.3
8. 209.85.241.212 0.0% 24 64.1 49.5 38.6 73.8 14.0
9. 209.85.251.249 0.0% 24 38.4 39.8 38.0 47.1 2.2
10. 209.85.242.49 0.0% 24 39.5 39.0 38.4 39.6 0.3
11. fra02s17-in-f20.1e100.net 0.0% 24 39.0 38.6 38.1 39.1 0.3
Report output
mtr can also be executed in a report mode (-r). The number of requests is stated with the parameter -c. With -w, it is achieved, that long host names are displayed completely and not cut off:
user@tpw:~$ mtr -r -w -c 10 www.google.com HOST: tpw Loss% Snt Last Avg Best Wrst StDev 1.|-- dsldevice.lan 0.0% 10 96.9 42.2 1.3 99.8 47.3 2.|-- XXXXX(Provider)XXXXX.at 0.0% 10 19.9 20.7 19.4 28.3 2.7 3.|-- 195.3.66.157 0.0% 10 19.6 19.4 18.9 20.1 0.3 4.|-- 195.3.68.1 0.0% 10 21.9 22.3 21.9 22.7 0.2 5.|-- 195.3.70.186 0.0% 10 22.5 29.8 22.2 87.5 20.4 6.|-- 62.47.120.150 10.0% 10 46.2 34.3 26.3 76.8 17.2 7.|-- 209.85.243.119 0.0% 10 26.7 27.3 26.4 33.0 2.0 8.|-- 209.85.241.212 0.0% 10 51.9 54.6 40.1 61.6 6.1 9.|-- 209.85.251.249 0.0% 10 38.9 38.8 38.7 39.0 0.1 10.|-- 209.85.242.49 0.0% 10 39.7 39.3 38.8 40.2 0.4 11.|-- fra02s17-in-f18.1e100.net 0.0% 10 39.0 38.6 38.2 39.0 0.2 user@tpw:~$
Graphical output
The graphical version is started with the xmtr command or with mtr at Debian/Ubuntu:
xmtr www.google.com
Analysis
For more distant sites, you can determine which hops (routers) are connected by submarine cable connections (for example, across the Atlantic).
For more distant pages, you can use the respective "round-trip time" to determine which hops (routers) are involved submarine cable connections (for example, across the Atlantic). This can be seen when analyzing the connection to www.areca.com.tw:
user@tpw:~$ mtr -r -w -c 10 www.areca.com.tw
HOST: tpw Loss% Snt Last Avg Best Wrst StDev
1.|-- dsldevice.lan 0.0% 10 42.9 63.0 42.7 97.5 21.8
2.|-- 194-166-175-254.adsl.highway.telekom.at 0.0% 10 19.5 20.8 19.4 28.9 3.0
3.|-- 195.3.66.157 0.0% 10 18.7 19.3 18.5 19.8 0.4
4.|-- 195.3.68.1 0.0% 10 21.9 27.1 21.7 70.7 15.3
5.|-- 195.3.70.178 10.0% 10 22.5 25.4 21.8 39.3 6.3
6.|-- win-b4-link.telia.net 0.0% 10 22.7 22.7 22.4 23.0 0.2
7.|-- prag-bb1-link.telia.net 0.0% 10 28.9 28.7 28.4 29.2 0.3
8.|-- ffm-bb1-link.telia.net 0.0% 10 99.3 56.1 46.7 99.3 18.9
9.|-- ash-bb3-link.telia.net 30.0% 10 142.3 149.8 136.7 193.0 19.5
| `|-- 213.155.131.145
| |-- 213.155.135.61
| |-- 80.91.250.203
| |-- 213.155.135.57
10.|-- sjo-bb1-link.telia.net 80.0% 10 215.8 212.9 210.0 215.8 4.1
| `|-- 213.155.135.129
11.|-- chunghwa-ic-155505-sjo-bb1.c.telia.net 80.0% 10 204.6 208.6 204.6 212.7 5.7
12.|-- r4001-s2.tp.hinet.net 50.0% 10 346.3 345.5 343.3 346.4 1.3
13.|-- 220-128-12-2.HINET-IP.hinet.net 90.0% 10 341.3 341.3 341.3 341.3 0.0
14.|-- tpdt-3011.hinet.net 90.0% 10 346.4 346.4 346.4 346.4 0.0
15.|-- TCHN-3011.hinet.net 80.0% 10 357.6 358.1 357.6 358.5 0.6
16.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0
user@tpw:~$
This query apparently travels between the following routers via a long submarine cable connection across the ocean, as indicated by the large differences in the average ping times (Avg):
- between hop 8 (56.1 ms) and 9 (149.8 ms)
- between hop 11 (208.6 ms) and 12 (345.5 ms)
More information
- Information on normal traceroute on Linux: Linux Network Analysis with traceroute
 |
Author: Werner Fischer Werner Fischer, working in the Knowledge Transfer team at Thomas-Krenn, completed his studies of Computer and Media Security at FH Hagenberg in Austria. He is a regular speaker at many conferences like LinuxTag, OSMC, OSDC, LinuxCon, and author for various IT magazines. In his spare time he enjoys playing the piano and training for a good result at the annual Linz marathon relay.
|
 |
Translator: Alina Ranzinger Alina has been working at Thomas-Krenn.AG since 2024. After her training as multilingual business assistant, she got her job as assistant of the Product Management and is responsible for the translation of texts and for the organisation of the department.
|
[[Category::Linux-Netzwerk]]
