66

When I do:

 $ traceroute 8.8.8.8

I get in the output showing only stars, even though pinging to google.com ( 8.8.8.8) appears to be working.

  1. What do I need to fix in my files/conf in order to solve this issue?
  2. what I need to check?

Ping command output

 $ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=73.4 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=46 time=69.6 ms

traceroute command output

 $ traceroute 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets 1 * * * 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * *
Improve this question
6
  • This is usually specific to the local network you're connected to but you might want to check your firewall and/or try with a disabled local firewall. Commented Apr 28, 2014 at 23:31
  • is it posible to make a deep verification from my linux machine ? ( by linux commands ) in order to understand the problem -- please help Commented Apr 28, 2014 at 23:52
  • @Eytan, please see the updated answer. I have mentioned the configuration files that needs to be changed. Commented Apr 28, 2014 at 23:54
  • hi the configuration are the same on both machines , the machines are the same , so what next , what I need to check? Commented Apr 29, 2014 at 8:17
  • i can't even traceroute to localhost, how strange Commented Oct 24, 2018 at 6:39

3 Answers 3

Reset to default
65

I found that traceroute -I gave me more complete results.

-I, --icmp Use ICMP ECHO for probes
Improve this answer
3
  • 7
    I get connect: Operation not supported Commented May 9, 2020 at 21:57
  • This requires root privileges. Commented Feb 16, 2022 at 20:21
  • -T to use TCP port 80 did it for me. eg traceroute -T google.com Commented Mar 2, 2022 at 7:59
32

The asterisks you're seeing are servers that your packets are being routed through whom are timing out (5.0+ seconds) and so traceroute defaults to printing the *.

NOTE: There's even a warning about this in the traceroute man page.

excerpt

In the modern network environment the traditional traceroute methods can not be always applicable, because of widespread use of firewalls. Such firewalls filter the "unlikely" UDP ports, or even ICMP echoes. To solve this, some additional tracerouting methods are implemented (including tcp), see LIST OF AVAILABLE METHODS below. Such methods try to use particular protocol and source/destination port, in order to bypass firewalls (to be seen by firewalls just as a start of allowed type of a network session).

Most firewalls block traffic outbound on ports other than TCP/80 which is the default IP port for web traffic. traceroute in Linux default use UDP, ping use ICMP, so as your output, it seems that ICMP packets are allowed in your firewall whereas UDP packets are blocked by the firewall.

You can see responses to my question titled: traceroute and ping from school network.

EDIT #1

As per the comments, if this is working in another RHEL machine and not working in this RHEL machine, I would suggest doing the below steps.

From the working RHEL machine (machine A), copy the /etc/sysconfig/iptables file. In the faulty RHEL machine (machine B), copy the original /etc/sysconfig/iptables file to something like /etc/sysconfig/iptables.original. 

$ cp /etc/sysconfig/iptables /etc/sysconfig/iptables.original

This step is just to ensure that if something goes wrong with our setting, we can revert back to the original. Now, copy the /etc/sysconfig/iptables from the machine A to machine B.

Improve this answer
9
  • so the stars are a bad sign? - they indicate about problem ? Commented Apr 28, 2014 at 23:34
  • but if they block by the Firewall so I have problem - Commented Apr 28, 2014 at 23:37
  • but how to know if the problem in my linux machine / or maybe the problem is some external isshue? Commented Apr 28, 2014 at 23:38
  • this machine is in the network I have some other machine but the output on the other machine is diff ( not all stars ) Commented Apr 28, 2014 at 23:39
  • did you mean about the linux firewall ? or other firewall ? Commented Apr 28, 2014 at 23:43
10

Either the machine you are running the tests from or your local gateway (router) is blocking UDP or ICMP. Make sure these are allowed in your firewall / NAT rule configuration.

Improve this answer
3
  • 15
    A bit more detail on how to do that would be helpful. Commented Apr 29, 2014 at 5:35
  • please advice about the commands that need to run on my linux machine in order to check the firewall / NAT as you explained Commented Apr 29, 2014 at 8:06
  • 1
    ICMP per se is not being entirely blocked as the OP is doing pings. Commented Jan 21, 2019 at 9:47

You must log in to answer this question.