Shotgun
Traceroute
How the burst works.
What replies reveal.
Autonet Team
Why probe with three protocols?
Filtering and reply behavior vary by protocol.
| Probe | Destination confirmation |
|---|
| TCP SYN to port 443 | Matched SYN-ACK or RST |
| ICMP Echo Request | Matched Echo Reply |
| UDP to a high port | Matched Port Unreachable from target |
Each protocol supplies a separate view of the same target.
The IPv4 header sets the reach
TTL selects how far a probe can travel.
20-byte header without options. Protocol: ICMP = 1, TCP = 6, UDP = 17.
Routers decrement TTL. Expiry can return ICMP Type 11, Code 0.
One paced burst across TTLs
20 TTLs × 3 protocols = 60 probes by default
| Sent TTL | TCP SYN | ICMP Echo | UDP |
|---|
| 1 | 0 ms | 10 ms | 20 ms |
| 2 | 30 ms | 40 ms | 50 ms |
| … | … | … | … |
| 20 | 570 ms | 580 ms | 590 ms |
Then collect for up to 2 seconds after the final send.
Nominal schedule, not a benchmark. Capture runs throughout.
An ICMP reply carries the evidence
Time Exceeded quotes the probe that expired.
Outer IPv4 responding router to sender
ICMP Type 11 / Code 0 + checksum + unused
Quoted IPv4 original source, destination and protocol
First 8 payload bytes enough to identify a sent probe
| Probe | Fields inside those 8 bytes |
|---|
| TCP | Source port + destination port + sequence |
| ICMP Echo | Type / code + checksum + identifier + sequence |
| UDP | Source port + destination port + length + checksum |
Look up the sent probe to recover its TTL and send time. RTT = receive time − send time.
ECMP: identity versus flow consistency
Changing a probe identifier can change the forwarding hash.
With --ecmp | Held steady | Probe identity |
|---|
| TCP | Addresses + ports | Sequence number |
| ICMP | Identifier + checksum | Sequence number |
| UDP | Addresses + ports + length | Checksum |
Payload compensation keeps ICMP’s checksum fixed and sets UDP’s checksum to the probe token.
Experimental. One sampled flow per protocol, with no guarantee for arbitrary hash inputs.
What the measurement tells you
| Observation | Interpretation |
|---|
| A matched destination reply | Destination responded to that probe |
| Different replies at the same TTL | Protocol-specific observations |
| An unanswered probe | A gap with several possible explanations |
A bounded sample of replies, with uncertainty preserved.
0:00–0:20 · Shotgun Traceroute
Shotgun sends a paced burst of TCP, ICMP and UDP probes across a range of TTLs, then collects the replies together. It gives us several protocol perspectives within one bounded measurement. The interesting part is how packet headers let us recover hop information even when replies arrive out of order.
0:20–0:55 · Why probe with three protocols?
Filtering and response policies differ by protocol. TCP SYN uses port 443 by default. A matched SYN-ACK or RST with the expected acknowledgment confirms a response from the target. ICMP uses Echo Request and Echo Reply. UDP uses a high destination port and looks for Port Unreachable from the target, ICMP Type 3, Code 3. Intermediate routers can return Time Exceeded for all three. These remain separate protocol observations and may follow different routes.
Sources: RFC 792
0:55–1:35 · The IPv4 header sets the reach
This is an IPv4 header arranged in 32-bit rows. With no options, IHL is five words and the header is twenty bytes. TTL occupies byte eight. Forwarding routers decrement it and discard the packet when it expires. An ICMP Time Exceeded response can identify the responding router. The next byte identifies the payload protocol: one for ICMP, six for TCP, seventeen for UDP. The IPv4 header checksum changes as TTL changes. Shotgun sends separate packets with initial TTLs one, two and so on. The destination stays the same.
Sources: RFC 792 · RFC 791
1:35–2:10 · One paced burst across TTLs
Shotgun does not wait for one TTL to answer before sending the next. With twenty TTLs and three protocols, sixty probes leave at nominal ten-millisecond intervals. Capture runs throughout the burst, followed by up to two seconds of collection after the final send. It can finish sooner once every probe has matched. This avoids serial waits on silent hops. These times describe the schedule rather than a benchmark. Pacing reduces burst intensity, but routers can still rate-limit replies.
2:10–3:20 · An ICMP reply carries the evidence
There are two IP headers here. The outer header belongs to the reply and identifies the responding device. Inside the ICMP error is a quotation of the original IPv4 header plus at least eight payload bytes. For TCP, those eight bytes contain both ports and the sequence number. For Echo, they include the identifier and sequence. For UDP, they contain the full eight-byte header. Shotgun checks the quoted addresses, protocol and identifying bytes against its sent probes. A match retrieves the original sent TTL and timestamp. The quoted TTL may already have changed in transit, and the reply has its own TTL. Neither replaces the recorded send TTL. Subtracting send time from receive time gives RTT, including the return path. The diagram shows a Time Exceeded error. Direct TCP and Echo replies use their own matching rules.
Sources: RFC 792
3:20–4:15 · ECMP: identity versus flow consistency
Load balancers commonly hash addresses, protocol and ports. Classic UDP probing changes the destination port, which can accidentally select a different ECMP branch at each TTL. Experimental ECMP mode holds selected fields steady. TCP uses its sequence number for identity. ICMP varies its sequence and compensates in the payload to keep its checksum fixed. UDP holds ports and length fixed and uses a distinct checksum, with a compensating payload word. The IP identification field also stays fixed within a flow. This follows Paris-style reasoning, but devices can hash additional fields, perform per-packet balancing or rewrite packets. TCP, ICMP and UDP still represent separate flows. This mode does not enumerate every branch.
Sources: Paris traceroute
4:15–5:00 · What the measurement tells you
Read the result as observations grouped by sent TTL and protocol. A matched destination response confirms that probe received an answer. A reset does not mean an open port, and a SYN-ACK does not establish application health. Silence can mean filtering, reply rate limits or connectivity trouble. One unanswered probe cannot establish a loss rate. Adjacent responding addresses do not prove a physical link. Shotgun gives a bounded mixed-protocol sample, with the packet evidence needed to inspect how each reply matched and where uncertainty remains.