The tcpdump command allows us to capture all or some
of the network traffic on a particular network device. In this
question use the tcpdump command to capture the behaviour of
traceroute.
The traceroute command send packets with short time to
live packets (ttl) and waits for a particular ICMP response to
indicate that the time has expired. Use tcpdump and traceroute together
to find out the ICMP packet id which does this.
Capturing packets sucessfully can be tricky, especially since you have
to use the same network to talk to your machine, and you dont want to capture
that too... Therefore consider the following commands to perform the capturing.
prompt> tcpdump -i eth0 not port 23 and not port 22 > /tmp/log &
[1] 3123
prompt> traceroute 10.200.0.1
...blah...blah
...blah...blah
prompt> kill -1 %1
[1]+ Done ....
prompt>
Now, look at the contents of /tmp/log and enter in the box below the ICMP
id involved in traceroute knowing that the ttl has been exceeded.
ICMP id used by traceroute: