Subject: Re: icmp: time exceeded in-transit [tos 0xc0]
To: Zafer Aydogan <zafer@gmx.org>
From: Patrick Mackey <netbsd@deniedaccess.org>
List: netbsd-users
Date: 01/04/2005 10:58:33
> I noticed following with tcpump.
> If I use the traceroute program mtr, and look at the network stream

> I get the error "time exceeded in-transit".
> But if I normally ping (without mtr) the same host (heise.de), the message
> disappears.
>
> Anybody knows what the error means?

When an IP packet traverses a router it's TTL is decremented. When the TTL 
gets to zero the packet is discarded and an ICMP "time exceeded 
in-transit" packet is generated and sent back to the source host (to 
notify the sending host that the packet was discarded).

traceroute, mtr, lft and various other trace route packages send packets 
with different TTLs to try to elicit these ICMP messages. They can then 
guess at the route which packets take to get to a destination.

You can google around and get more info; if you so desire. You could also 
even read the traceroute(8), mtr(8), or lft(8) manpages :)


-- 
Best Regards,
Patrick Mackey

------------------------------------------
  /"\
  \ /        ASCII Ribbon Campaign
   X          Against HTML Mail
  / \ 
------------------------------------------