Why traceroute ignores route table in AWS EC2 with VPC

Question:

Here my route table in AWS EC2 with VPC

I expect traffic to internet will go throw 10.10.32.1

Instead it goes throw 52.56.0.2 Where is 52.56.0.2 specified? Why it does not go throw 10.10.32.1

Answer:

First we can see two things – VPC traffic routing and how traceroute works

  • VPC traffic routing

    When you create a subnet, five IP’s of the subnet are being reserved for internal purpose out of which the second ip x.x.x.1 (for your subnet it is 10.10.32.1) is being used for vpc gateway (virtual) and from route table you could see by default all traffic goes to it and from the gateway it is being routed to next target based on the subnet’s route table rules. The next target could be another gateway (for public subnet) or it could be a NAT (private subnet) if destination is not inside the local network. For outside internet traffic, the packets are routed to one of the aws internet routers from vpc internet gateway, for your case its IP is 52.56.0.2.

  • Traceroute working

    Briefly traceroute works on ICMP protocol, it initially send packet with TTL as 1 and when it gets ICMP time exceeded error from any router it record the router IP and send another Packet with last TTL + 1 and it does till it reaches the target.

Now coming to the question on why 10.10.32.1 IP is not recorded in traceroute is because those intermediate VPC gateways are not decrementing the TTL values and just for forwarding the packets to next hop, when the packet reaches the internet routers then normal decrement process started happening and ICMP error message is being sent back and recorded.

Leave a Reply