Contents

The contents of this help file are basically the same as the printed documentation, but the organization and breaks are a bit different.  This contents page will lead you into the topics in a logical order.

License Agreement

Jump Right In

Requirements

Initial Setup

What Is NeoTrace

More Details

How Do I…

Perform a Trace

Check WhoIs Information

Print or Save Results

Hunt Spammers

The Details

Keyboard Shortcuts

The User Interface In Detail

Pop-Up Menu Actions

Configuration

Geographical Tracing

Finding and Submitting LOC Data


Requirements

In order to use NeoTrace you will need:

•	A computer running a 32 bit version of Windows.  This includes Windows 95 or later and Windows NT 4.0 or later and includes Windows 2000.  Windows 3.11 with Win32s will not work with NeoTrace.

•	A non-proxy connection to the Internet.  This can be through a dial-up connection, cable or DSL connection or an office LAN.  If your connection to the Internet is only through a proxy server you will not be able to use NeoTrace.  If you are behind a firewall and it is not configured to allow traceroute and ping you will not be able to use NeoTrace.  Firewalls can be reconfigured to allow NeoTrace to operate.  Proxies can be replaced by or supplemented by a true NAT (network address translator).  Talk to your network administrator for more information.

•	ICMP.DLL and WININET.DLL.  These are common DLLs that are installed on the majority (99%) of computers that meet the previous two requirements.  If you receive an error message indicating that you are missing one of these DLLs when you start NeoTrace see the Troubleshooting section later in this manual.

If your only connection to the Internet is through a proxy server you may not be able to use NeoTrace.


KeyBoard Shortcuts

All program functions can be performed with the mouse.  For your convenience many functions can also be performed with the keyboard.

F5	Start Trace
Esc	Stop Trace
Ctrl + Enter	Complete address with www. - .com and start trace
Ctrl + D	Delete current trace
Ctrl + G	Go Online (Open NeoTrace Home Page)
Ctrl + N	Toggle Ping
Ctrl + O	View Option Dialog
Ctrl + P	Print
Ctrl + S	Save
Ctrl + T	Start/Stop Trace
Alt + G	Change to Graph View
Alt + L	Change to List View
Alt + M	Change to Map View
Alt + N	Change to Node View
Alt + Left	View Previous Trace Tab
Alt + Right	View Next Trace Tab
Alt + 1	View Trace Tab 1
Alt + 2	View Trace Tab 2
Alt + 3	View Trace Tab 3
Alt + 4	View Trace Tab 4
Alt + 5	View Trace Tab 5

Additionally when you have a view with a scroll bar, such as the List view or Node view you can scroll the view with the PgUp, PgDN, Home and End keys.


Initial Setup

Get up and running.  If you haven’t already installed NeoTrace do so now.  Just run the installation program that you downloaded or received on disk.  The installation program will automatically create the installation directory, start menu items, and an icon on your desktop.  If you have a ‘quick launch’ area on your Windows task bar you can move this desktop shortcut there for easy access to NeoTrace.

If you use a dial-up connection make sure you are connected before continuing.

The default configuration settings are sure to work on all systems.  They are just to set personal preferences in how NeoTrace should behave.  The only setting you need to make immediately is your Home Location.

Home Location

The first time you run NeoTrace it will ask you to set up your Home Location.

It is necessary to tell NeoTrace your home location so that it can accurately represent your trace start location on the map. Enter in as much information as possible into this dialog. Be sure to include your 2-letter country code.

The 2-letter country code is the same as that used on domain names in your country, such as US, CA, UK etc.  You can see a list of country codes in the NeoTrace help file.

City location data is not yet available for all countries. If a specific location for your hometown or city is not available a default location for your country (typically the capital) will be returned. If you wish to get a better location right away you can enter it by hand after you look it up through the NeoWorx website or other means.

If you are in the US please be sure to enter your zip code for an accurate location determination.

City and zip code locations are generally accurate to within a mile or two.  This is more than enough accuracy for today’s purposes.

Run a Trace

Now try it out.  Click on the ‘Address’ text drop-down and enter the name of a computer to trace to, or pick one of the sites that is already in the list.

Hit the ‘Trace’ button.  The trace begins immediately, you will hear a series of sounds and the display will begin updating with information.  Don’t worry if it seems a bit confusing at first.  Eventually the sounds will give you instant feedback on how a trace is progressing and the display will make perfect sense.

While the trace is in progress the globe graphic in the upper right corner of the screen will spin and status messages will appear on the status bar at the bottom of the window.  When the trace is complete the globe stops and you will hear a light sound that indicates trace completion.  You can also stop a trace before completion by hitting the ‘Stop’ button that replaces the ‘Trace’ button while a trace is in progress.

Continuous pinging is turned on by default.  This causes the traced nodes to be pinged repeatedly after the completion of the trace itself.  It is accompanied by a ‘dink’ or ‘boop’ sound (depending on your point of view) after each round of pings.  You can tell you have pinging turned on when the ‘Ping’ button on the tool bar is depressed and lit bright green.  In most cases you should turn off continuous ping unless you have a reason to monitor the results or wish to measure average results for the route over time.

View the Results

Assuming the trace is completed successfully you will see a series of nodes starting with your computer and ending with the target computer.  You can view the results in several different ways, switch between these views with the tabs at the left side of the screen.

Moving the mouse over each node will reveal a tool-tip type box listing more details about the node.  You can also right-click on any node to reveal a pop-up menu with further options for detailed information or action.

Navigate the Map

When the trace is complete the map will be moved and zoomed to fit the entire trace into your current window size.  You can zoom in and out and scroll around the map using the mouse.  To zoom in and out click with the left and right mouse buttons.  To move the map around simply click and drag on the map.


More Info

Using NeoTrace is as simple as putting in the name of a computer to trace to and hitting ‘Trace’.  While performing the trace the program will also collect all the information available about nodes along the route.

The default Node display shows the name or IP address of each node and the ping time to that node.

Ping time indicates the length of time it takes for a packet of data to travel from your computer to that distant computer and back.  The time only indicates the round trip to that one computer and is not directly related to the time on previous nodes.

It is possible to have a lower time on a more distant node and a high time on a closer node.  The cause is the node with the higher time being efficient at routing traffic along but giving lower priority to responding to the ping request.  This is not at all unusual.

Multiple Traces

You can have up to 5 traces in memory at the same time.  Tabs are added to the bottom of the window as new traces are started.  Only the visible trace is active, all other traces are stopped when they are not visible.  This includes pinging.

If a trace is in progress and you start a new trace you will get an additional trace result tab on the bottom of the screen for the new trace.  The previous trace that was in progress is stopped and cannot be resumed, it will have to be started over again.

Continuous pinging is only active for the currently visible trace.  Multiple pinging of routes would deliver inaccurate results, as the times would be affected by the traffic of pings to other routes.

To close a trace result tab double-click on it, or press Ctrl+D to remove the trace tab that is on top.

Ping Time and Traffic

The Ping Time is greatly affected by the amount of traffic on your connection.  If you see a sudden and dramatic worsening of ping times it is usually due to a web page transfer, file download or email poll.  The slower your connection the larger the effect traffic will have on the ping time.

The Graph

When looking for trends in ping time the Graph is the most useful view.  You can easily see the overall results at a glance.  When continuos pinging is turned on you can also see the low, high and average response times for each node.

A blue line indicates the average time.  This is the average of the last three responses.  The high and low response times are indicated by a range line and tick marks.

Vertical lines run at 250ms intervals and the background color corresponds to the node colors on the Node view to match the ‘node speed’ ranges you have set in the Options.

Node 1 is not drawn on the graph, this is your computer and is always at a ping time of 0.

You will generally see a left to right trend in ping times.  Ping times naturally increase as nodes are farther away.  If you see high local ping times that decrease in the middle this often indicates high traffic on the local or ISP network.  Nodes with high ping times are typically dealing with more traffic or are on the other side of a slower or lower-bandwidth link.

Sudden jumps in the ping time when tracing overseas generally indicates the point where the traffic moves over a long distance.  The node on the short end of the jump is the last node in your country, and the next node is the first node in the next country.  This is particularly apparent in traces that cross the Pacific or Atlantic.


What is NeoTrace?

NeoTrace is a multi-purpose Internet tool used for finding information and trouble-shooting.

At the simplest level NeoTrace shows you how packets (data) get from your computer to another computer on the Internet.  You see all the nodes (equipment of various types on the Internet that is passing traffic) between your computer and the trace target.

There are many applications for this information.  NeoTrace is a useful tool when troubleshooting connections or just verifying that everything is working OK.  There is also a wealth of information presented by NeoTrace, including the domain owners, relative locations, and in some cases geographical location of nodes.

Internet professionals, home users, law enforcement and many others use NeoTrace.

All traffic on the Internet is made up of packets of data that travel between multiple computers or nodes from their destination to their source.  The path that these packets traverse is called the route.

The structure of the Internet has a long history and many aspects of it are a result of the evolution it has made from the original network into the global data infrastructure it is used as today.  One of these aspects is that there is no single route between any two distantly spaced nodes.  Another aspect is that you are at the mercy of the intervening route for the performance of your traffic.

Regardless of how fast your connection to ‘the Internet’ is the slowest point in the route limits your overall connection to another site.  The chain is only as strong as its weakest link.

Latency is the time it takes for data to travel the route.

Bandwidth is the amount of data that can travel through the connection in a given period of time.

Besides using NeoTrace to look for weak spots in a connection you can use it to:

•	Discover if you can’t reach a site due to a failure at your ISP or further into the Internet.

•	Determine the point of a network failure that is preventing you from reaching a web site.

•	Determine the geographic location of sites

•	Track down the origin of unwanted emails (‘spam’).

•	Monitor performance.

•	Uncover the owners of a site.

•	Determine the type and quality of connection a site has to the net.

•	Get detailed contact information on sites all over the world (when available).


Basic Use

1.	Enter the name or IP number you would like to trace to into the combo box labeled “Host to trace”.

2.	Press the button at the top of the toolbar (trace).

3.	View the results in the Trace Display

You can also pick a previously traced site to trace again by using the drop-down portion of the combo box.

During the trace information is returned the trace display is updated.  If you move your mouse over the nodes you will see pop-up windows that display further information about the nodes, including the name and address of the owner if available.  If you wish to terminate a trace before it completes press the trace button again.  Its appearance will indicate whether a trace is in progress.

At any time there are nodes on the screen you can view additional information about the nodes by moving the mouse cursor over the nodes and viewing the small windows that appear.

Once the trace is complete you can get additional information and options through a contextual menu.  Move the mouse pointer to the node you are interested in and right-click to view this menu.

You can toggle re-ping of the destination node or the route with the button in the upper right corner of the display.  Ping settings are in the configuration dialog.


Node Meanings

The icons used to represent nodes have several meanings.  They are intended to convey the type or location of node and the relative ‘speed’ or latency of traffic to that site.

The latency is indicated from better to worse by green, yellow, red and gray icons.

‘Top level’ domains, i.e. domains which are not contained within a two-letter country domain, are indicated by special icons which represent NET, COM, MIL, GOV and EDU.

The flag of each country represents sites with names contained by a two-letter country domain.

On the map view the shape and size of the node dot has further meaning.

	Home location.  Appears at the value you have set in Options.  If you have not set a valid value the start location will appear off the coast of California or in the mid-Atlantic and has no meaning.
	DNS-LOC derived location or from private database (neotrace.gdt).  Response to DNS-LOC query returned valid lat/lon data or match was found in local private data.
	Zip code or Address derived location.  Location based on address, used only for destination nodes.  May be wildly inaccurate.
	NeoWorx-LOC derived location.  Data was returned from local or remote NeoWorx LOC database.
	No location data.  Node location is currently unknown or cannot be reasonably inferred.
Remember: Nodes with shadows imply a ‘solid’ location.  Squares/diamonds are derived from databases managed by people, circles are guesses made by computers.


Go Online

Clicking the animated logo in the top right corner will open your default web browser to view the NeoWorx home page or a special page at the NeoWorx web site.

This page is customized for your version of NeoTrace and will display:

•	The version of NeoTrace you are using

•	Upgrade information when appropriate

•	Additional help or FAQ information

•	Ordering or Upgrade information

Please be sure to use this button occasionally to check for updated information.


Performing a Trace

Select the site you want to trace to.  You may type in a new computer name, select one from the list of previous traces, or you can drag a link out of your web browser onto NeoTrace.

To trace to the site you are currently viewing in your web browser, grab the icon just to the left of the site URL in the navigation bar.  The icon will vary depending upon the browser you are using, but they all work the same.  For example:

Internet Explorer 4

Netscape Navigator 4

Internet Explorer 3

Netscape Navigator 3

Drop it onto the NeoTrace window.  The site name will appear in the Host to Trace window and the trace will begin.  You cannot drop a link if there is a trace in progress.

The route from your computer to the target will start to form.  Very quickly you will see the full path to the other computer.  Initially each node in the path will be labeled with its IP address.  As NeoTrace resolves the names for each node, the IP will be replaced with a ‘human friendly’ name.

If you move your mouse pointer over the nodes a small window will pop up displaying further details about the node, including the round trip (ping) time to the node and the address of the person or organization that owns the node if that information is available.

In some cases the address (whois information) will not be available.


Checking WhoIs information

As the trace progresses and finishes NeoTrace will query for detailed ‘WhoIs’ information.  This is a set of information about a site with the following format:

1.  Company name and address

2.  Domain name (i.e. neoworx.com)

3.  Contact information for administrative, billing and technical needs

4.  Date information on the creation and most recent update of this information

5.  The servers which are responsible for providing the DNS info for this domain

The format for the information returned from international servers may be a bit different.  Some formats are very long and because of this you may not be able to see useful information unless you get the WhoIs Details from the pop-up menu.

Unfortunately the majority of countries do not have WhoIs servers available.  This makes retrieval of information on them impossible.  Check the NeoWorx web site for up to date information on which domains can be queried.


Printing or Saving results

The results of a trace can be output to the printer, a text file or to simple HTML format.  You have a choice of the degree of information included in the output as well.

Simple

Displays the node number, hostname, IP address and timing results (essentially the same as command line traceroute)

Standard

Also displays short WhoIs results (essentially the normal NeoTrace results)

Detailed

Includes detailed WhoIs results

To change the style of output choose Options and make your selection.

To Save results pick Save from the File menu or use the Save button on the tool bar.  From the save dialog you can choose either HTML or TEXT format.

To Print results choose Print from the File menu or the Print button on the tool bar.


Finding and Submitting LOC Data

The world needs your data.  As explained in the previous section there is no universal (or even minimally available) source of geographic location data for Internet nodes.  By pitching in and submitting any data you have you can help us to improve the quality and accuracy of geographic tracing for everyone.

The Basics

You probably know where several nodes on the Internet are located without even realizing it. At least the computer you are sitting at, and the node it is connected to.

In general you are connected either through a dial-up/cable connection or through a LAN at your office. You will notice that for every trace you perform the first node out from your computer is always the same. This is your 'gateway' into the Internet.

Identifying its location is usually simple. If you are in an office LAN it is in the same building as you and you can locate it very precisely. If you are connected through a dial-up you can at least identify the town where this gateway is located.

Even if you can only locate this node to within a major city it is an improvement over no location at all. Depending on the country you live in you may be able to use the 'prefix' or 'exchange' of the number you dial to get a more accurate location. Generally these consist of a 2 or 3 digit value that indicates the local central switching office. Your phone book may have a listing of these numbers and the areas they correspond to. In the US this will be a 3-digit value and local values are always listed in the front of the phone book.

Once you have determined the name or IP address of the node you dial into, and its approximate location you can add it to your local data, or more conveniently add it to the global data through this web site.

With most ISPs you will have a number of different nodes that you connect to when you dial in. These are chosen at random, you may want to keep a list for a few days and note the IP addresses and/or names of all these machines.

Are You a Guru?

Are you sitting in an office humming with computers?  CPUs stacked like cordwood beside your desk?  Then you know where some computers are!

You have first-hand information on the location of nodes and we invite you to share the data.  It is important for you to realize that security is not an issue.  The lat/lon data is not accurate enough for someone to actually physically find the machine with it.

Contrary to what some ISPs and even non-ISP companies delude themselves into thinking locations and interconnection points are not proprietary information.  It’s all right there for the taking by anyone who cares to run enough traces from different locations.  It is better to have you share accurate data than to have a Net Hunter extrapolate possibly inaccurate data from the surrounding nodes.  Companies with strong ‘net backbones should promote that fact lest they be interpreted as weak.

Are You a Net Hunter?

We have some users that figure out node locations for fun.  This is as much art as it is science and you may find that you have ability for it and enjoy it.

When you perform a trace and notice nodes with no location data take a quick look at them.  There are several means you can use to figure out their location.

The first thing to do is look at the machine name, assuming that the name was resolved and it isn’t just an IP address.  Often the machine name contains a clue to the location.  Sometimes it is obvious with an entire city name spelled out.  Other times it is more obscure, a 2- or 3-letter abbreviation for the city name.  It may also be the 3-letter code for the nearest airport.

That information alone is not enough to be sure the node is located in that city.  Take a look at the nodes on either side of it.  Where do they seem to be located?  Does it fit a logical pattern?

Be careful, in some cases the machine name may indicate where the connection leads to, a distant city, not the city the equipment is actually sitting in.

If you think you have the makings of a net hunter be sure to keep an eye out for our release of NeoGraph, the companion tool to NeoTrace.  This tool will let you easily create and submit new data to our shared database.

Come Submit Data

Our LOC resources page is the starting point for finding lat/lon data given a City, Airport or Postal code, and for submitting new LOC data.

http://www.neoworx.com/loc/

Data file updates and new tools will be made available on this page whenever they are available.


Geographical Tracing

The map view is the most interesting feature for most people.  However you need to approach it with care.  Of all the information presented by NeoTrace the map is the only view that may contain inaccuracies.  All other information reported by NeoTrace is based on standard Internet protocols and conventions.  Geographical placement of nodes is not a standard or supported feature of any Internet protocol.

NeoTrace is cautious in its placement of nodes.  Rather than being overly optimistic about location data NeoTrace was designed to be pessimistic.  This helps reduce instances of map displays that appear to provide meaningful information but are incorrect.  It is better to not know than to be wrong.

DNS-LOC and RFC 1876

There is a proposed standard for providing and retrieving geographic location data for Internet nodes.  NeoTrace makes use of this proposed standard, described in RFC 1876.  We encourage the use of DNS-LOC and hope to see it become more popular.

The number of sites supporting DNS-LOC is currently very limited.  This combined with the number of extra requests that must be made to determine if a site supports it limits the efficiency of this method.  Depending on the speed of your computer and Internet connection you may find you get better performance with DNS-LOC turned off.  You can toggle this in the Options dialog.

We expect that as people become more aware of the possibilities and usefulness of geographical node location data a formal standard will be finalized and widely accepted.

NeoWorx LOC

Without a readily available source of location data we have had to create one.  NeoWorx maintains a large geographic database covering the entire Internet.  This gives us a central repository for data and allows us to easily provide local caches of data that greatly speed the results available to you.

Acquiring and maintaining this data is a daunting task.  We invite you to submit any information you have.  You very likely have some useful information without even realizing it.  Details on creating and submitting LOC data is later in this document.

Many users wonder why we don’t always use the country domain (two letter extension such as .uk) to determine the approximate location of a node.  The main reason is that the country domain is not a reliable indication of the physical location of the node.  Many web sites that have country domains are actually located in the US.  You will frequently find a domain with a certain country domain in a completely different country.  For example the French Yahoo web server (www.yahoo.fr) is physically located in Sweden.

Similarly the address of the registrant is not always a good indication of node location.  In the case of Internet backbone nodes (90% of the stuff between you and your destination) the address has nothing to do with the physical location of the node.  This is because the address is for the corporate headquarters of company that owns the network that node belongs to.  Even in the case of end nodes it can be wildly wrong, for example the Internet Movie Database (IMDB) is operated by people in the UK, and that is the address that appears on the WhoIs information for the node.  However the main servers (US Mirror) are located in Milwaukee Wisconsin, in the northern middle of the US.

Private LOC

In addition to submitting data to the shared NeoWorx LOC database, you can create LOC data for your own private use.  This data is stored in the file neotrace.gdt.

A utility will be available to make editing this data simple.  Until then you can edit the file with any text editor.  Be sure you use a simple text editor that will save in plain ascii format, such as notepad. (The other local LOC data files are in a special compressed format to save space and cannot be edited without special tools).

The file consists of single-line entries with a pattern and a latitude/longitude value.  The first line of the file indicates the total number of entries in the file.  Be sure to increment this value if you edit the file by hand.

Example:

Count=2

www.neoworx.com=-39.55,84.22

*.neoworx.com=-35.28,82.43

Entries can contain a simple machine name or have * wildcards at the beginning or in the middle.  The precision (number of decimal places) of the lat/lon values can be as high or low as you like.

In addition to the basics this example demonstrates another principle of this file.  NeoTrace will search through this file from top to bottom and return as soon as it finds a match.  In this case most machines in the neoworx.com domain are located in the location indicated by the wildcard, but the web server is located in a different place.

Note:  NeoTrace 2 Beta includes a neotrace.gdt file as an example.  The final release of NeoTrace (and future releases) will not include this file as it is not necessary to NeoTrace itself; and data which could be contained here would be better served in the other cache files.  If you download additional betas and have made modifications to your neotrace.gdt file be sure to make a backup copy of the file.

The Home Location

You must set up your ‘home’ location in NeoTrace.  This is done through the Home Location dialog from the Options dialog.

If you are in the US you can simply enter your ZIP code and ‘US’ and it will be used to determine your approximate location.

For other countries enter your country name or abbreviation and the name of the town or city you live in.  Extensive location data is available for most countries and NeoTrace will be able to pinpoint your starting location.  Be sure you enter your country name accurately in its international/English version.  If in doubt simply use the two-letter ISO abbreviation.  If you do not yet know the ISO abbreviation for your country you can obtain it from the NeoTrace help file topic ‘Country Codes by Country Name’

Resources to aid you in determining your lat/lon position are available on the NeoWorx web site, including a database of large world cities sorted by country.  These resources are available at:

http://www.neoworx.com/loc/

Reading the Map

The shape of symbols used on the map to indicate node locations indicates how that location was derived.  In the case of the small round symbols with no shadow there is no location information.

Nodes with unknown locations are strung at even intervals between nodes with known locations.  This is done to help make these nodes accessible to mouse-clicks and has no implied relation to their actual locations.  In some circumstances the end node location is not known or estimated in which case any unknown nodes will continue along the last path direction.  This typically has no real meaning.

In some instances there will not be any location derived for any nodes of the trace.  The result will be a string of unknown location nodes proceeding to the SE of the home location.  In this circumstance the map view should be ignored, as it contains no useful results.

Map Node Symbols

	Home location.  Appears at the value you have set in Options.  If you have not set a valid value the start location will appear off the coast of California or in the mid-Atlantic and has no meaning.
	DNS-LOC derived location or from private database (neotrace.gdt).  Response to DNS-LOC query returned valid lat/lon data or match was found in local private data.
	Zip code or Address derived location.  Location based on address, used only for destination nodes.  May be wildly inaccurate.
	NeoWorx-LOC derived location.  Data was returned from local or remote NeoWorx LOC database.
	No location data.  Node location is currently unknown or cannot be reasonably inferred.
Remember: Nodes with shadows imply a ‘solid’ location.  Squares/diamonds are derived from databases managed by people, circles are guesses made by computers.

‘Crazy’ Traces

Geographical tracing will reveal to you just how seemingly illogical the electronic landscape can be.  It is not at all uncommon for your traffic to go all the way across the country only to come back to a site right next door.  Many users outside the US will see traffic go from their country to another country before going to the country that is the final destination.  For example users in New Zealand may see traffic go from there to the US and back to NZ again.

There are many reasons for this apparent nonsense.  In most cases it is poor peering.  Even though you may be physically near a site if you and that site are connected to different networks the traffic may have to go quite some distance before finding a common connecting point.  Remember that the Internet is not a single network, nor is it homogeneous (or even rational) in any sense.

In the New Zealand example it is caused by local ISPs not being peered with each other.  This means that they have not created a connection or bridge between their two networks.  When this is the case the traffic gets routed out to a point where a path can be found from one network to the other.

Within the US there are several major peering locations.  The most well known of these are MAE-WEST and MAE-EAST, located in San Jose and Washington DC.  There are also major network peering points in Chicago, Dallas, New Jersey and more within the US.  Due to the history of the Internet there are still many international networks that only connect to the Internet through one or two points.  This traffic is then forced to go through those few points, frequently in the US.

Nearly all Canadian Internet traffic destined overseas flows into the US first.  This is due to another reason for major amounts of traffic flow through the US; cheaper rates.  Due to the competitive nature of the US telecomm industry, and the relatively controlled international telecomm (mainly government owned monopolies that aren’t good for anyone) the rates in the US are vastly cheaper.

Fortunately this situation is improving rapidly.  As with most aspects of the Internet change is fast and constant.  It has only been a couple years since major new connections have been established between countries in Asia and the improvements are already tremendous.  As recently as 1996 most traffic between Singapore and Japan went by way of California but now there is an Asian backbone.

You will still see some strange things happen.  Even though lots of companies have equipment at the MAEs, NAPs and other interconnection points, it doesn’t always mean that they are peered with each other. In the trace on this page you can see that the route passes through Atlanta twice because it is forced to go all the way to Miami to find a point where the networks can peer with each other.  Presence of equipment in the same city, sometimes even in the same building, is no guarantee of rational peering.

You may also see traces to the same endpoint that change over time.  Traffic can be routed differently due to network failures, network congestion or simple load balancing.  It is even possible to see the end point of the trace change completely.  This may seem illogical at first, but remember that a web site is frequently made up of many computers that share the load.  There is no requirement that these servers all be located in the same place.  Deliberately placing these servers in widely separated locations can improve performance for users and offer a margin of safety in case of network failures.

Don’t forget to use your head.  You have powers of intuition that your computer does not have.  If you see a trace is clearly proceeding in a certain direction and then the very last node is placed in a totally different location, the placement is obviously wrong.  This will occur when the physical location of the node could not be determined by any means other than the address of the owner, and that owner’s address is different from the approximate location of the server.

Get the Latest Data

From time to time we produce updated local LOC data cache files.  You can download these from our web site and update your copy of NeoTrace.  You can check for the latest files any time on our LOC data pages at:

http://www.neoworx.com/loc/


Configuration

Select the ‘Config’ button from the tool bar to access the configuration dialog.  This dialog lets you set options for NeoTrace.

Click on the dialog image below for help specific to that feature

General Options:

Toggle the playing of sounds during trace and ping events with the sound checkboxes at the bottom of the dialog.

The grid lines on the map view can be turned off by unchecking the Display map lines item.

If you want to use DNS LOC (RFC 1876) location data turn on this checkbox.  It is left off by default because actual implementation of this spec is very sparse and the performance cost is not worth the tiny amount of data out there currently.


Home Location Setting

The first time you run NeoTrace it will ask you to set up your Home Location.

It is necessary to tell NeoTrace your home location so that it can accurately represent your trace start location on the map. Enter in as much information as possible into this dialog. Be sure to include your 2-letter country code.

City location data is not yet available for all countries. If a specific location for your hometown or city is not available a default location for your country (typically the capital) will be returned. If you wish to get a better location right away you can enter it by hand after you look it up through the NeoWorx website or other means.

If you are in the US please enter your zip code for an accurate location determination.


The User Interface

The NeoTrace interface follows typical Windows program conventions.

Address

This is the name or IP address of the trace target.  You can type in a value, or choose a recently used value by clicking the arrow and selecting an item from the list.

You can also drag an address from your browser.  Grab a link or the address icon on your browser and drag it to the NeoTrace window and drop it.  It will be parsed and placed into the Address text.

Toolbar

Start tracing with the Trace button.  When a trace is in progress it will change into a Stop button that can be used to cancel the trace in progress.  Starting a new trace while a trace is in progress will also result in the trace in progress being cancelled.

Selecting Save offers you a dialog where you can set the type of format to save the trace results in and save the file.  Your format choices are formatted text or HTML.  The text formatting requires a fixed width font for proper viewing.

You can Print the trace results as well.  The printed format is the same as the file save format and does not include a graphical view of the trace.

Use the Copy button to place a text version of the trace results into the clipboard.  You can then paste it into a document or email message.

After a trace is complete you can continuously Ping the target or the entire route.  Toggle pinging with the ping button on the toolbar, and set the ping options in the Options dialog.

Bring up the Options dialog with this button.  See the Configuration (page 18) section below for details.

Action Animation

This animation is active when NeoTrace is actively performing a trace and retrieving information on the trace.  When a trace is complete the animation will stop.  You can open the NeoWorx home page by clicking on the image.

Trace Tabs

NeoTrace creates a new tab at the bottom of the window for each new trace you perform.  There is a limit of five tabs, the oldest tab will be removed if you start an additional trace.

To remove a tab you can double-click on it.  You can also remove the tab you are currently viewing with the View menu or with the shortcut Ctrl+D.

View Modes

The trace results can be viewed in several different ways.  These different interpretations of the results allow you to quickly understand and find the data you are looking for.

Each viewing mode is accessed through a tab at the left.

The Nodes view corresponds to the ‘traditional’ view used by NeoTrace prior to version 2.0.  It is an abstract representation of the trace path.  This view is most meaningful while the trace is in progress and when you want to see the logical relationship between nodes.  This is the clearest representation of the trace path itself.

The Map view is an attempt to place the nodes of the trace geographically.  Geographical placement of nodes an inexact science.  Read the Geographical Tracing (page 22) section for details.

The List view is a simple textual list of the basic stats for each node in the trace.

For a quick visual representation of the ping time to each node in the trace use the Graph view.  If you have continuous route pinging turned on you will also see the average of the last three results.  This average is usually a better indicator of overall route performance than the most recent results.

Pop-Up Info

Placing the cursor over a node in any of the views will bring up a pop-up information box.  This box shows some of the details about the node including its position in the trace, address details and simple WhoIs results.

Of particular value is the network that the node is located on, if it can be determined.

Pop-Up Menu

If you right-click on a node you will get a pop-up menu with further action you can take on the node.  This is described in the following section.


Pop-Up Menu Actions

Further action can be taken on individual nodes.  Right-click on a node to view the pop-up menu and choose a further acton to take.

Printing the node will sent its details to the printer.  These details can also be viewed in the WhoIs Details in this menu.  This will open a dialog box with the complete WhoIs results for the node.

You can Copy the WhoIs results to the clipboard for further use in email or another program.

The results for an individual node can be retrieved over again with Refresh.  The timing results and average ping can be viewed with Timing Details.

Full details for the Network owner can be viewed as well.  This includes full registrant information including physical address and any other information provided by them.

If a node is determined to have HTTP (web browser) services the Goto item becomes available.  Choosing this menu item will cause the node to be opened in a web browser.


NeoTrace and Your Privacy

Information Visible to Others

Using NeoTrace does not expose any information to the outside world that is not already available.  Similarly NeoTrace cannot collect any information that is not available through standard channels and protocols.  NeoTrace just makes it a lot faster and more convenient and makes it easier to visualize the data.

There is only one feature of NeoTrace you should use with caution.  This is the ‘port scanning’ feature available through the pop-up node menu.  The menu item is ‘Server Types…’ and it hits that node with a large number of traffic requests on a wide range of ports.  Some sites will interpret this as a prelude to a hacker attack.

That is of course pure paranoia and is not true.  An intelligent hacker does not start an attack by alarming security at a site with such a commonplace search for information.  Still, you want to be prepared for people asking you why you port scanned them, and it would be wise to avoid port scanning your ISP or employer.

Information Collected by NeoWorx

The loss of privacy that can occur when everything is computerized is disturbing.  We do collect some data from your use of NeoTrace and this is fully explained right here.

Approximately once a month NeoTrace makes an HTTP request to one of our servers.  This HTTP request is to “phone home” and see if there is a newer version of the program available.  The server responds back with either a ‘no’ or a ‘yes’ with a URL for a page you can go to that will explain about the new release.

We think this is a useful feature.  It is unobtrusive, and it ensures that you are never more than a month behind the latest and greatest version of the software.

NeoTrace does not report any personal information of yours to our server.  In fact NeoTrace isn’t in possession of any personal information.  The only thing it knows that is unique to you is your approximate latitude and longitude and we don’t need that, though we may collect it for statistical purposes at a later time.

We collect statistics on the number of version check requests made to our server.  This gives us an idea of how many people are using NeoTrace and when.  It makes us happy to know that there are hundreds of thousands of people using and benefiting from our program, even if most of them haven’t paid for it yet.

NeoTrace 2 will also make requests to our server for geographical information from our LOC database.  We may collect statistics on this information in order to improve the performance and accuracy of this data.


Speed Indicators

Because different response times are suitable for different applications and connection types, you may configure the node speed display.

Note: In this context ‘speed’ refers to latency, or the time it takes traffic to travel, not bandwidth, which is the quantity of traffic.  All modems, regardless of bandwidth, are high-latency.

To change the speed ranges choose the Config button from the toolbar and then the ‘Adjust Speeds…’ button.  This will display the ‘Speed Indicators’ dialog.

There are default settings available in this dialog for ‘Fast’ and ‘Slow’ connections.

Generally speaking you should choose the ‘Slow’ defaults any time a modem is involved in your Internet connection.  For example if you connect to the Internet by dialing in with your modem.  In some office situations you may be connected via Ethernet to the rest of the network but the connection from your network into the Internet is through a modem or other relatively slow connection.  In this case as well you should choose the slow defaults.

If your connection to the Internet is through an ISDN connection or through an office LAN with a high-speed connection such as a T1, T3 or partial T1 you should choose the ‘Fast’ defaults.

Advanced users can customize the speed ranges to their particular needs.  When you drag the sliders their behavior may seem a little confusing at first.  This is because as you adjust the slider you are adjusting the upper limit for the range of that color, and by definition you are simultaneously adjusting the lower limit for the range above it.


Output options

The last option affects the output of the trace when you pick the ‘Output’ button on the NeoTrace toolbar. There are three different styles of output available.

•	Simple – Trace list only

•	Standard – Trace list and brief WhoIs

•	Detailed – Trace list and full WhoIs details

See Printing or Saving Results for more information.


Cache

NeoTrace records the information it receives from the DNS (node name), WhoIs (node owner) and location queries. Each of these are stored in separate caches. If you perform traces frequently these caches can grow large.

More importantly information may change, and if it is only retrieved from the cache it will no longer be accurate.  For this reason you may wish to configure your cache information to expire more frequently.

To clear a cache now simply press the appropriate clear button.


Display Options

Each node is labeled with one or two lines of text and is colored to indicate its relative ‘speed’ or ping time.

Select the information you would like displayed for each node from the list of available items in the ‘Top Line Text’ and ‘Bottom Line Text’ drop-down controls.

The available label items are:

•	Domain Name

•	Response Time

•	Highest Response Time

•	Average Response Time

•	Lowest Response Time

•	IP Address

•	Geographic Location

If you want a single-line display select ‘None’ for the second line.


Continuous Pinging

To simplify investigation of the performance of a particular node or path you can turn on continuous pinging.  This causes NeoTrace to ping either the destination node or every node on the route in turn upon completion of the trace.

Toggle pinging with this button

You can choose no pinging, pinging of just the destination node, or pinging of every node on the route with the radio buttons at the left.

The update frequency is how often the ping will be performed.  The time out value is how long NeoTrace will wait for a response before giving up on the node responding.


Changing Fonts

You may alter the font used to display the node labels.  When you select the font configuration button a standard font dialog will appear.  You may choose any font that is installed on your system for the display.

Note that NeoTrace does not prevent you from picking fonts that look terrible, use your own discretion.


Latency Indicators

The relative speed of nodes is indicated by color.  This is an indication of how long it takes a packet (data) to make a round trip between your computer and that particular computer.  Note that the time can vary between traces, and may vary a great deal at different times of the day due to traffic conditions on the Internet.  The color ranges can be adjusted in the configuration dialog.

Display	Default Speed Ranges
Graphic	Meaning	Fast	Slow
	Fast Node	0-100ms	0-250ms
	Moderate Node	101-750	251-1000
	Slow Node	751-5000	1001-5000
	Very Slow or Unresponsive Node	>5 seconds	>5 seconds

Nodes indicated with flags use a bar of colored squares above them to indicate relative speed.  The colors have identical meanings to the colors used in other nodes as indicated in the above table.  The length of the color bar also relates to the relative speed and has no separate meaning.


US and Top Level Symbols

The function of a node is indicated by the symbol used to represent it.  The currently supported types are:

Graphic	Type
	Generic node	This is used for any node that does not fall into the other categories
	NET	These nodes are typically Internet providers, international gateways, or part of the Internet backbone.
	EDU	US Educational institutions
	MIL	US Military
	GOV	US Government


By Country Name (in English)

Source: ISO 3166 Maintenance Agency

CODE	Country
AF	AFGHANISTAN
AL	ALBANIA
DZ	ALGERIA
AS	*AMERICAN SAMOA
AD	ANDORRA
AO	ANGOLA
AI	*ANGUILLA
AQ	*ANTARCTICA
AG	ANTIGUA AND BARBUDA
AR	ARGENTINA
AM	ARMENIA
AW	*ARUBA
AU	AUSTRALIA
AT	AUSTRIA
AZ	AZERBAIJAN
BS	BAHAMAS
BH	BAHRAIN
BD	BANGLADESH
BB	BARBADOS
BY	BELARUS
BE	BELGIUM
BZ	BELIZE
BJ	BENIN
BM	*BERMUDA
BT	BHUTAN
BO	BOLIVIA
BA	BOSNIA AND HERZEGOWINA
BW	BOTSWANA
BV	*BOUVET ISLAND
BR	BRAZIL
IO	*BRITISH INDIAN OCEAN TERRITORY
BN	BRUNEI DARUSSALAM
BG	BULGARIA
BF	BURKINA FASO
BI	BURUNDI
KH	CAMBODIA
CM	CAMEROON
CA	CANADA
CV	CAPE VERDE
KY	*CAYMAN ISLANDS
CF	CENTRAL AFRICAN REPUBLIC
TD	CHAD
CL	CHILE
CN	CHINA
CX	CHRISTMAS ISLAND
CC	*COCOS (KEELING) ISLANDS
CO	COLOMBIA
KM	COMOROS
CG	CONGO
CD	*CONGO, THE DEMOCRATIC REPUBLIC OF THE
CK	*COOK ISLANDS
CR	COSTA RICA
CI	COTE D'IVOIRE
HR	CROATIA (local name: Hrvatska)
CU	CUBA
CY	CYPRUS
CZ	CZECH REPUBLIC
DK	DENMARK
DJ	DJIBOUTI
DM	DOMINICA
DO	DOMINICAN REPUBLIC
TP	*EAST TIMOR
EC	ECUADOR
EG	EGYPT
SV	EL SALVADOR
GQ	EQUATORIAL GUINEA
ER	ERITREA
EE	ESTONIA
ET	ETHIOPIA
FK	*FALKLAND ISLANDS (MALVINAS)
FO	*FAROE ISLANDS
FJ	FIJI
FI	FINLAND
FR	FRANCE
FX	*FRANCE, METROPOLITAN
GF	FRENCH GUIANA
PF	*FRENCH POLYNESIA
TF	*FRENCH SOUTHERN TERRITORIES
GA	GABON
GM	GAMBIA
GE	GEORGIA
DE	GERMANY
GH	GHANA
GI	*GIBRALTAR
GR	GREECE
GL	*GREENLAND
GD	GRENADA
GP	*GUADELOUPE
GU	*GUAM
GT	GUATEMALA
GN	GUINEA
GW	GUINEA-BISSAU
GY	*GUYANA
HT	HAITI
HM	*HEARD AND MC DONALD ISLANDS
VA	HOLY SEE (VATICAN CITY STATE)
HN	HONDURAS
HK	*HONG KONG
HU	HUNGARY
IS	ICELAND
IN	INDIA
ID	INDONESIA
IR	IRAN (ISLAMIC REPUBLIC OF)
IQ	IRAQ
IE	IRELAND
IL	ISRAEL
IT	ITALY
JM	JAMAICA
JP	JAPAN
JO	JORDAN
KZ	KAZAKHSTAN
KE	KENYA
KI	KIRIBATI
KP	KOREA, DEMOCRATIC PEOPLE'S REPUBLIC OF
KR	KOREA, REPUBLIC OF
KW	KUWAIT
KG	KYRGYZSTAN
LA	LAO PEOPLE'S DEMOCRATIC REPUBLIC
LV	LATVIA
LB	LEBANON
LS	LESOTHO
LR	LIBERIA
LY	LIBYAN ARAB JAMAHIRIYA
LI	LIECHTENSTEIN
LT	LITHUANIA
LU	LUXEMBOURG
MO	*MACAU
MK	MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF
MG	MADAGASCAR
MW	MALAWI
MY	MALAYSIA
MV	MALDIVES
ML	MALI
MT	MALTA
MH	MARSHALL ISLANDS
MQ	*MARTINIQUE
MR	MAURITANIA
MU	MAURITIUS
YT	*MAYOTTE
MX	MEXICO
FM	MICRONESIA, FEDERATED STATES OF
MD	MOLDOVA, REPUBLIC OF
MC	MONACO
MN	MONGOLIA
MS	*MONTSERRAT
MA	MOROCCO
MZ	MOZAMBIQUE
MM	MYANMAR
NA	NAMIBIA
NR	NAURU
NP	NEPAL
NL	NETHERLANDS
AN	*NETHERLANDS ANTILLES
NC	*NEW CALEDONIA
NZ	NEW ZEALAND
NI	NICARAGUA
NE	NIGER
NG	NIGERIA
NU	*NIUE
NF	*NORFOLK ISLAND
MP	*NORTHERN MARIANA ISLANDS
NO	NORWAY
OM	OMAN
PK	PAKISTAN
PW	*PALAU
PA	PANAMA
PG	PAPUA NEW GUINEA
PY	PARAGUAY
PE	PERU
PH	PHILIPPINES
PN	*PITCAIRN
PL	POLAND
PT	PORTUGAL
PR	*PUERTO RICO
QA	QATAR
RE	*REUNION
RO	ROMANIA
RU	RUSSIAN FEDERATION
RW	RWANDA
KN	SAINT KITTS AND NEVIS
LC	SAINT LUCIA
VC	SAINT VINCENT AND THE GRENADINES
WS	SAMOA
SM	SAN MARINO
ST	SAO TOME AND PRINCIPE
SA	SAUDI ARABIA
SN	SENEGAL
SC	SEYCHELLES
SL	SIERRA LEONE
SG	SINGAPORE
SK	SLOVAKIA (Slovak Republic)
SI	SLOVENIA
SB	SOLOMON ISLANDS
SO	SOMALIA
ZA	SOUTH AFRICA
GS	*SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS
ES	SPAIN
LK	SRI LANKA
SH	*ST. HELENA
PM	*ST. PIERRE AND MIQUELON
SD	SUDAN
SR	SURINAME
SJ	*SVALBARD AND JAN MAYEN ISLANDS
SZ	SWAZILAND
SE	SWEDEN
CH	SWITZERLAND
SY	SYRIAN ARAB REPUBLIC
TW	TAIWAN
TJ	TAJIKISTAN
TZ	TANZANIA, UNITED REPUBLIC OF
TH	THAILAND
TG	TOGO
TK	*TOKELAU
TO	TONGA
TT	TRINIDAD AND TOBAGO
TN	TUNISIA
TR	TURKEY
TM	TURKMENISTAN
TC	*TURKS AND CAICOS ISLANDS
TV	TUVALU
UG	UGANDA
UA	UKRAINE
AE	UNITED ARAB EMIRATES
GB	UNITED KINGDOM
US	UNITED STATES
UM	*UNITED STATES MINOR OUTLYING ISLANDS
UY	URUGUAY
UZ	UZBEKISTAN
VU	VANUATU
VE	VENEZUELA
VN	VIET NAM
VG	*VIRGIN ISLANDS (BRITISH)
VI	*VIRGIN ISLANDS (U.S.)
WF	WALLIS AND FUTUNA ISLANDS
EH	*WESTERN SAHARA
YE	YEMEN
YU	YUGOSLAVIA
ZR	ZAIRE
ZM	ZAMBIA
ZW	ZIMBABWE

* Indicates no flag implemented in current version of NeoTrace


By Code

Source: ISO 3166 Maintenance Agency

Code	Flag	Country
AD		ANDORRA
AF		AFGHANISTAN
AG		ANTIGUA AND BARBUDA
AI		*ANGUILLA
AL		ALBANIA
AM		ARMENIA
AN		*NETHERLANDS ANTILLES
AO		ANGOLA
AQ		*ANTARCTICA
AR		ARGENTINA
AS		*AMERICAN SAMOA
AT		AUSTRIA
AU		AUSTRALIA
AW		*ARUBA
AZ		AZERBAIJAN
BA		BOSNIA AND HERZEGOWINA
BB		BARBADOS
BD		BANGLADESH
BE		BELGIUM
BF		BURKINA FASO
BG		BULGARIA
BH		BAHRAIN
BI		BURUNDI
BJ		BENIN
BM		*BERMUDA
BN		BRUNEI DARUSSALAM
BO		BOLIVIA
BR		BRAZIL
BS		BAHAMAS
BT		BHUTAN
BV		*BOUVET ISLAND
BW		BOTSWANA
BY		BELARUS
BZ		BELIZE
CA		CANADA
CC		*COCOS (KEELING) ISLANDS
CD		*CONGO, THE DEMOCRATIC REPUBLIC OF THE
CF		CENTRAL AFRICAN REPUBLIC
CG		CONGO
CH		SWITZERLAND
CI		COTE D'IVOIRE
CK		*COOK ISLANDS
CL		CHILE
CM		CAMEROON
CN		CHINA
CO		COLOMBIA
CR		COSTA RICA
CU		CUBA
CV		CAPE VERDE
CX		CHRISTMAS ISLAND
CY		CYPRUS
CZ		CZECH REPUBLIC
DE		GERMANY
DJ		DJIBOUTI
DK		DENMARK
DM		DOMINICA
DO		DOMINICAN REPUBLIC
DZ		ALGERIA
EC		ECUADOR
EE		ESTONIA
EG		EGYPT
EH		*WESTERN SAHARA
ER		ERITREA
ES		SPAIN
ET		ETHIOPIA
FI		FINLAND
FJ		FIJI
FK		*FALKLAND ISLANDS (MALVINAS)
FM		MICRONESIA, FEDERATED STATES OF
FO		*FAROE ISLANDS
FR		FRANCE
FX		*FRANCE, METROPOLITAN
GA		GABON
GB		UNITED KINGDOM
GD		GRENADA
GE		GEORGIA
GF		FRENCH GUIANA
GH		GHANA
GI		*GIBRALTAR
GL		*GREENLAND
GM		GAMBIA
GN		GUINEA
GP		*GUADELOUPE
GQ		EQUATORIAL GUINEA
GR		GREECE
GS		*SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS
GT		GUATEMALA
GU		*GUAM
GW		GUINEA-BISSAU
GY		*GUYANA
HK		*HONG KONG
HM		*HEARD AND MC DONALD ISLANDS
HN		HONDURAS
HR		CROATIA (local name: Hrvatska)
HT		HAITI
HU		HUNGARY
ID		INDONESIA
IE		IRELAND
IL		ISRAEL
IN		INDIA
IO		*BRITISH INDIAN OCEAN TERRITORY
IQ		IRAQ
IR		IRAN (ISLAMIC REPUBLIC OF)
IS		ICELAND
IT		ITALY
JM		JAMAICA
JO		JORDAN
JP		JAPAN
KE		KENYA
KG		KYRGYZSTAN
KH		CAMBODIA
KI		KIRIBATI
KM		COMOROS
KN		SAINT KITTS AND NEVIS
KP		KOREA, DEMOCRATIC PEOPLE'S REPUBLIC OF
KR		KOREA, REPUBLIC OF
KW		KUWAIT
KY		*CAYMAN ISLANDS
KZ		KAZAKHSTAN
LA		LAO PEOPLE'S DEMOCRATIC REPUBLIC
LB		LEBANON
LC		SAINT LUCIA
LI		LIECHTENSTEIN
LK		SRI LANKA
LR		LIBERIA
LS		LESOTHO
LT		LITHUANIA
LU		LUXEMBOURG
LV		LATVIA
LY		LIBYAN ARAB JAMAHIRIYA
MA		MOROCCO
MC		MONACO
MD		MOLDOVA, REPUBLIC OF
MG		MADAGASCAR
MH		MARSHALL ISLANDS
MK		MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF
ML		MALI
MM		MYANMAR
MN		MONGOLIA
MO		*MACAU
MP		*NORTHERN MARIANA ISLANDS
MQ		*MARTINIQUE
MR		MAURITANIA
MS		*MONTSERRAT
MT		MALTA
MU		MAURITIUS
MV		MALDIVES
MW		MALAWI
MX		MEXICO
MY		MALAYSIA
MZ		MOZAMBIQUE
NA		NAMIBIA
NC		*NEW CALEDONIA
NE		NIGER
NF		*NORFOLK ISLAND
NG		NIGERIA
NI		NICARAGUA
NL		NETHERLANDS
NO		NORWAY
NP		NEPAL
NR		NAURU
NU		*NIUE
NZ		NEW ZEALAND
OM		OMAN
PA		PANAMA
PE		PERU
PF		*FRENCH POLYNESIA
PG		PAPUA NEW GUINEA
PH		PHILIPPINES
PK		PAKISTAN
PL		POLAND
PM		*ST. PIERRE AND MIQUELON
PN		*PITCAIRN
PR		*PUERTO RICO
PT		PORTUGAL
PW		*PALAU
PY		PARAGUAY
QA		QATAR
RE		*REUNION
RO		ROMANIA
RU		RUSSIAN FEDERATION
RW		RWANDA
SA		SAUDI ARABIA
SB		SOLOMON ISLANDS
SC		SEYCHELLES
SD		SUDAN
SE		SWEDEN
SG		SINGAPORE
SH		*ST. HELENA
SI		SLOVENIA
SJ		*SVALBARD AND JAN MAYEN ISLANDS
SK		SLOVAKIA (Slovak Republic)
SL		SIERRA LEONE
SM		SAN MARINO
SN		SENEGAL
SO		SOMALIA
SR		SURINAME
ST		SAO TOME AND PRINCIPE
SV		EL SALVADOR
SY		SYRIAN ARAB REPUBLIC
SZ		SWAZILAND
TC		*TURKS AND CAICOS ISLANDS
TD		CHAD
TF		*FRENCH SOUTHERN TERRITORIES
TG		TOGO
TH		THAILAND
TJ		TAJIKISTAN
TK		*TOKELAU
TM		TURKMENISTAN
TN		TUNISIA
TO		TONGA
TP		*EAST TIMOR
TR		TURKEY
TT		TRINIDAD AND TOBAGO
TV		TUVALU
TW		TAIWAN
TZ		TANZANIA, UNITED REPUBLIC OF
UA		UKRAINE
UG		UGANDA
UM		*UNITED STATES MINOR OUTLYING ISLANDS
US		UNITED STATES
UY		URUGUAY
UZ		UZBEKISTAN
VA		HOLY SEE (VATICAN CITY STATE)
VC		SAINT VINCENT AND THE GRENADINES
VE		VENEZUELA
VG		*VIRGIN ISLANDS (BRITISH)
VI		*VIRGIN ISLANDS (U.S.)
VN		VIET NAM
VU		VANUATU
WF		WALLIS AND FUTUNA ISLANDS
WS		SAMOA
YE		YEMEN
YT		*MAYOTTE
YU		YUGOSLAVIA
ZA		SOUTH AFRICA
ZM		ZAMBIA
ZR		ZAIRE
ZW		ZIMBABWE

* Indicates no flag implemented in current version of NeoTrace


WhoIs

WhoIs information is a sort of ‘white pages’ for the Internet provided by domain registration authorities.

At the present time most international authorities have either no whois available or very poorly maintained servers or information.  For this reason you will find that international whois information returned is spotty.

The address shown does not always indicate the location of a node.  This is particularly true of nodes that are part of the Internet backbone.  Every computer operated by a given domain owner will return the same WhoIs information.  You can sometimes get an idea of where a computer is actually located by looking at the nodes on either side of it, or at the name of the node itself.  Many backbone nodes have names that are related to the city or company they service.

You can add or update WhoIs server data yourself by editing the neowhois.ini file.  This file is written out with default servers the first time NeoTrace runs.

If you are aware of a whois server we do not currently support in NeoTrace please let us know!


Unreachable Nodes and Networks

This generally indicates that the target machine is behind a firewall which blocks the traffic used to perform the trace.  You will not be able to get an accurate trace to the target machine.

In some cases you may be the one behind a firewall which is not allowing your trace traffic out of the local network.  Contact your system administrator to see if he can help you get around the problem.


How NeoTrace Works

NeoTrace works by exploiting a feature of the Internet Protocol called TTL, or Time To Live. Originally, this data field in an IP packet header was supposed to contain a value representing the actual amount of time a packet could be flying around the Internet before a router would simply discard it. This was designed to eliminate packets that were endlessly looping around the network and therefore wasting bandwidth and router capability.

NeoTrace sends out a packet destined for the destination you specify. It sets the TTL field in the packet to 1. The first router in the path receives the packet, decrements the TTL value by 1, and if the resulting TTL value is 0, it discards the packet and sends a message back to the originating host to inform it that the packet has been discarded.

NeoTrace records the IP address and DNS name (if available) of that router, then sends out another packet with a TTL value of 2. This packet makes it through the first router, then times-out at the next router in the path. This second router also sends an error message back to the originating host. NeoTrace continues to do this, recording the IP address and name of each router until a packet finally reaches the target host, or until it decides that the host is unreachable. In the process, NeoTrace records the time it took for each packet to travel round trip to each router. Slow links are therefore pinpointed.


Using NeoTrace through a Firewall

It is possible to use NeoTrace through a firewall.  If the firewall is not already configured to permit the use of PING or TRACERT through it (by use of ICMP packets) the firewall will need to be reconfigured.

In order for NeoTrace (or ping for that matter) to operate through a firewall two rules must be added to the firewall configuration.  The first rule is to allow machines to send echo-requests. The second rule is to allow receipt of echo-replies. Depending on your particular firewall vendor the terminology used may be different but the principle holds true

NeoTrace makes use of ICMP (Internet Control Message Protocol) packets. ICMP packets are not associated with any particular port number.

Please note that changes to firewall configuration should only be made by a network administrator with an understanding of the characteristics of the firewall. Consult the documentation for your particular firewall for further information. Configuration changes that allow Ping to operate through the firewall will typically be documented, and these same procedures will allow use of NeoTrace.


Spam Hunting

We’ve all experienced ‘spam’; those unwanted, unsolicited bulk emails that extol the benefits of everything from Multi Level Marketing to water softeners. Sadly there is a lot of porn arriving the same way. They often use bogus return addresses and generally try to hide their tracks by any means possible.

The Internet has always been a free place where anything goes. However these people are creating a situation where governments may start legislating if we don’t police the situation ourselves.

Is it spam?

Before pursuing the source of a message be sure to determine if it really is spam.  You may be receiving a message because you subscribed to a mailing list, asked to be notified of web site changes or product updates, etc.

Does the body of the message contain unsubscribe instructions?  Email from a responsible organization will always contain unsubscribe instructions.  If so follow them.  Irresponsible organizations often include this as well, so consider carefully if this is mail related to something you asked for or not.

Did the sender attempt to obscure their identity?  If so they are definitely email abusers of the worst kind.

What can you do?

First of all never buy anything from a bulk emailer. If they’re not making a profit from bulk email, they’ll stop sending it.  Educate your friends and colleagues that they should not encourage this behavior either.  (Also for the sanity of us all ask them not to mass-forward email appeals and chain letters.)

“Spamming” is an anathema to most Internet service providers. They will give a spammer one warning before closing the account. Sometimes they don’t even give the first warning. With this knowledge and Neotrace you can hunt down these intruders.

Please take the moral high-ground when hunting spammers.  Don’t do anything improper, and always keep a pleasant tone when dealing with ISPs and agencies.  After all they aren’t the one’s sending the spam.

Reading Headers

First lets find the header. Where the header information is available to you will vary depending on the email software you are using.  If you’re using MS Internet Explorer 4 (Outlook Express), you can right click on the message and choose “properties”.  In MS Outlook open the message then choose view/options from the menu.  Some email programs show you all headers all the time (such as Eudora 3.0).

The email header consists of information related to the source and routing of the message.  Most of the time this information is of no interest to people which is why your email software generally does not display all of it.

Here’s a sample header

Return-Path: <we_deliver@mailexcite.com>

Received: from www.comune.collegno.to.it (root@www.comune.collegno.to.it [158.102.48.66]) by lucky.innet.com (8.8.7/8.8.7) with ESMTP id VAA03877 for <rgrun@innet.com>; Fri, 11 Sep 1998 21:07:03 -0400

From: we_deliver@mailexcite.com

Received: from www.comune.collegno.to.it (hil-dnppi-053.oh.compuserve.net [206.175.98.53]) by www.comune.collegno.to.it (8.8.6/8.8.6) with SMTP id DAA07201; Sat, 12 Sep 1998 03:06:23 +0200

Received: from we_deliver@mailexcite.com by we_deliver@mailexcite.com (8.8.5/8.6.5) with SMTP id GAA05956 for <we_deliver@mailexcite.com>; Fri, 11 Sep 1998 19:03:15 -0600 (EST)

Date: Fri, 11 Sep 98 19:03:15 EST

To: we_deliver@mailexcite.com

Subject: Do it for Yourself  or  We can Do it for You !

Message-ID: <Do It Yourself  or  We Can Do It For You>

Reply-To: we.deliver@mailexcite.com

X-PMFLAGS: 128 0

X-UIDL: 10000000000000000000000000000011

Comments: Authenticated sender is <we_deliver@mailexcite.com>

Status:

Notice the return path and the reply-to can be anything the sender chooses. In this case it’s we_deliver@mailexcite.com.

Your key to locating the source of the email is the ‘Received’ header entries.  Each of these entries indicates the message was passed from one email server to another one on the path from the originator to you.

Where did lucky.innet.com (the Internet provider for the email address in this example) get it? The next line holds the first clue; we_deliver@mailexcite.com who received it from www.comune.collegno.to.it Notice the IP address; They connect through compuserve with the IP of 206.175.98.53. Notice THEY received it from we_deliver@mailexcite.com.

Here’s what happened

The spammer used his correct mail address in the reply field. He “bounced” the message from his mailexcite account through www.comune.collegno.to.it. They are probably unaware that the spammer used their server. This is done to hide his tracks.

The trick is to follow back the “received from” names and IP addresses until you get to the originating domain

Sniffing Clues with NEOTRACE

Look at the header again. You can copy a name, an IP address or everything to the right of “@” in an email address.

In Neotrace trace to the source domain, “mailexcite.com” in this case. When it finishes hold you cursor over the last item. It should show all the information of the Internet service provider. Right click and choose “copy”. Now in your mail program FORWARD the spam.. Go to the bottom and PASTE the data from Neotrace. Next copy the header from the original spam and paste that on the bottom. Look in the data from Neotrace and you will see the domain’s business addresses. Copy them to the To: field. You may want to CC it to the addresses “Postmaster@<domain name>” and “abuse@<domain name>” One or both should be received by the Internet service provider. Write a quick and friendly note at the top of the letter and send it. The provider will be able to determine who sent the spam and usually close the account.

It is possible use an anonymous server to send spam. This strips the header and adds another. You won’t be able to trace this back.  Be assured that a person with enough experience to run an anonymous server finds a million messages going through his server, he will be able to handle the abuser in some truly unpleasant ways.

That’s all there is to it. Follow the steps above. Neotrace makes it easy and fun.

The Price of Spam

Even aside from laws relating directly to unsolicited mass email, there are specific legal and contractual penalties that will apply to most spammers.

Loss of account or connection

All responsible ISPs reserve the right to cut off customers that abuse its spam policy.  If you are able to notify the management of the ISP the spammer connects through you can get them shut down.

Mail Fraud

Many spammers are committing mail fraud without realizing it.  The penalties for mail fraud are very serious.  If convicted of mail fraud a spammer will very likely do prison time and be on probation at a minimum, often with restrictions placed on their Internet access.

Further Resources

Please visit our web site for a list of links to ‘spam hunting’ articles and anti-spam resources.

http://www.neoworx.com/neotrace/spam.asp


Common Problems and Solutions

When I try to run NeoTrace it fails with an error about it not being a Win32 application, what is wrong?

This indicates that the NeoTrace executable has become corrupted.  It is extremely likely that there is a virus present on your system.  You should immediately get the latest possible virus scanning software and check your system.

NeoTrace responds differently from other programs to some viral infections due to it being compressed and encoded with another product of ours called NeoLite.  In some cases this can serve as a first warning of viral infection.  This is a side effect of the main use of NeoLite, which is to make programs smaller, therefore it should not be relied upon as a virus detector.

Are the times shown for each node round-trip to me or between nodes?

The time at each node is the round-trip (ping) time from your computer to that node.  Times have no relationship to adjacent nodes.

Why then do you see nodes with higher times before nodes with lower times?  Since the time measured is the total round-trip, it includes the time it takes for that computer to respond, not just the travel time.  Many nodes, typically dedicated routers, are more efficient at passing traffic than they are at responding to our request.  This causes higher times in the midst of otherwise fast routes.

I can’t see WhoIs results

There are two times when you typically won't see WhoIs results (the detailed name and address info for a node).

The first and by far the most common is when the WhoIs servers are unavailable. This is beyond your control and ours.

If you are never able to get WhoIs information you may be blocked by your firewall or proxy. Port 43 needs to be enabled for TCP/IP traffic in order for it to work. Alert your system or network administrator if you think there is a problem.

Be certain to flush your WhoIs cache if you are experiencing this problem.

You must use Microsoft’s TCP/IP Stack

The method of implementation of the ICMP calls in NeoTrace has been tested only with the tcp/ip stack provided by Microsoft.  This stack is found on Windows 95 and Windows 98, as well as Windows NT 3.51 and up.  NeoTrace will work properly in this situation.

There is a known problem which prevents NeoTrace from working with other stacks.  At this point NeoTrace is known to not work with: Trumpet Winsock, Novell, and NetManage tcp/ip stacks.

Microsoft's WINSOCK doesn't support ICMP or RAW SOCKET's which are necessary for PING and Trace Route to work. Microsoft's incomplete WINSOCK doesn't work with these programs without some additional help files. Microsoft had to add ICMP.DLL to support these programs, PING and TRACEROUTE (tracert). These two programs call this ICMP.DLL. Due to how Microsoft added ICMP.DLL after the fact and not part of the Winsock, they don't use Winsock, therefore, these two applications won't work with other implementations of Winsock.

MS Winsock 2 fixes this problem, but because Winsock 2 has to be installed as an upgrade to the operating system we presently do not assume its existence.  Non-upgraded MS tcp/ip stack users represent the vast majority of users at the present.

This is a legacy issue that will be addressed in a future version of NeoTrace.

Destination Nodes with Different Names

Sometimes you may perform a trace to a certain location, and when it gets there NeoTrace labels it with a different name.  This is not an error, what you are seeing is the ‘true’ name of that computer.

A single physical computer can have many names and IP addresses assigned to it.  While this is not normally the case, it does happen frequently with web servers.  This allows a company to sell web space to many different organizations and have those organizations be able to have unique addresses, while serving all of them from a single machine or cluster of machines.

In some cases hundreds of separate domain URLs may resolve to a single machine.

You may also see a trace locate the destination machine, but the label never resolves back from being a numerical IP address.  This means that the ‘reverse DNS lookup’ for that IP address failed.  This is a DNS problem or reverse lookup of that IP address has been deliberately disabled.

Error Messages

The Errors you may see are:

•	No Response

•	Network Unreachable

•	Bad Destination

When you see ‘Bad Destination’ appear it means that the address could not be resolved, or that the IP number is invalid.  Basically you have entered an address which does not exist.  In some cases it may be that you have a valid address, but at this exact point in time it doesn’t exist as far as the Internet is concerned.  This can occur if the domain name server information for that site is being reconfigured and is fairly rare.  You may also see this problem occur (and constantly) if the domain name server your computer is using is not working correctly.

Changing Routes

The Internets underlying structure evolved from a network that was originally created to handle military traffic.  Part of its very nature is to be resistant to damage and to route around problems.  For this reason traffic across the Internet is not guaranteed to follow any particular path between two given points.  A stream of traffic is usually made of many separate packets.  These packets can all travel different routes and may not even arrive in the same order that they left in.

At different times of the day as traffic flow varies you may see different routes to different sites.  You can even see different routes taken on traces only seconds apart.

My System Crashes After Using NeoTrace for Awhile

You may have a common Windows 95 memory leak which causes this crash. To determine whether you need to update your system, use the Find utility in your Start Menu and look for the file "kernel32.dll". If the modification date on this file is prior to 2/2/96, you can download an update for some versions of Windows 95 at the link below.

Installing this file should eliminate the problem for users of the US English version of Windows 95. Unfortunately Microsoft advises not to install this update on the English Pan European version of Microsoft® Windows® 95 or any other non-English version of Windows 95. Please contact Microsoft support for information about the kernel update for these versions.

http://support.microsoft.com/support/kb/articles/Q148/3/36.asp

If you have never registered for Microsoft support, you may be prompted to answer a few questions before being presented with the download file.


No Response

On some traces you may see nodes labeled 'No Response'.  In some cases this indicates a computer that is not responding properly, and in other cases is a symptom of something else.

Large numbers of 'No Response' nodes generally indicates that the route you are tracing passes through a 'firewall'.   This is a method of defense for a portion of the Internet against unauthorized access from other parts of the network.  In order to provide added protection for computers behind that firewall it has been configured not to return information on the route that your data takes.  You will see this most frequently when you attempt to trace to certain commercial sites such as MSN.  Version 1.1 recognizes and eliminates bogus 'No Response' nodes from the trace.

Isolated 'No Response' nodes can be due to an incorrectly configured or deliberately mis-configured machine, and in some cases is due to a bug in the network code of that machine.

In some cases the target machine is returning datagrams with an incorrect TTL which causes it to appear that there are a great many more nodes in the route than there actually are.

In most cases there is no actual computer at the point where the 'No Response' message appears.


Diagnosing Connection Problems

In this section we make the assumption that you are attempting to view a web site and find that it is not working.  If it is a site you have never visited before, attempt tracing to it first.  In some cases you will find the site no longer exists.  In dealing with sites you visit often, it is more likely a network or connection failure.

Due to the nature of the Internet there are a large number of points where a connection can fail.  These possible failure points include:

•	The connection from your computer to your ISP (typically a modem)

•	The connection from your ISP to their provider or backbone

•	Backbone segments

•	Interconnection points

•	The connection from the backbone to the ISP of the site you are trying to reach

•	The connection from their ISP to the site

Power outages, equipment failures, severed cables or fiber, fire, earthquakes and more can cause failure.

Make a Baseline Trace

If you are not currently experiencing a connection problem as you read this, we suggest that you perform a trace to several sites you use frequently and print out or save the results.  This will give you useful information when you have problems later.

Is it You?

Your first goal is to determine whether the connection failure is in your local loop (the connection from you to your ISP) or further along.  Attempt to trace to your ISP’s main domain address.  This is typically your email server or the main web site of your ISP.  If you are unable to reach it then there is a problem with your connection.  You should attempt re-establishing your connection and check your hardware.  If you are still unable to get a good connection contact your ISP.

If you can reach servers at the ISP the next step is to trace to the site you are trying to reach.  If the trace reaches all the way to the target site and it does not appear as a ‘gray’ (no colors) icon then the target server is working.  If you do not already have it on you can turn on continuous pinging.  After a few pings right-click on the target node and view the timing details.  The important information to look for here is the total responses and percentage of dropped packets.  If there has been a response then traffic is getting through, if a high percentage of packets have been dropped then there is a connection problem.

If you see a packet loss of 30% or less then the connection is quite good enough for you to web browse, so if the site is not responding to your web browser there is another problem.  Either you have a browser problem or the web server software on the target site is crashed.  Determine if your browser is working properly by viewing other sites.  If it is working well you should send email to the webmaster at the target site informing them that you checked their site and can reach it but not web browse and that their server may be crashed.

ISP Failure

If your trace to the target site gets no further than your ISP it is likely they have had a connection failure.  Attempt tracing to several more sites and see if you can get any of them.  If all the sites you attempt to trace to fail you can be confident your ISP is suffering a major outage.  At this point you should attempt contacting technical support to make certain they are aware of the outage.

If you get a busy signal it is pretty obvious they are being inundated with calls already and are aware of the problem.  Stop calling and let them concentrate on fixing the problem.  If you get through the first thing you should ask is if they are aware of a network failure.  If they are not you should explain to them what you have seen and tried.  If they are aware of the problem politely ask if they have an estimate of when it will be fixed, thank them and hang up.

Backbone failures

If you find that you are able to reach some sites, but not others, or that there is a vast disparity in performance from what you normally see, then there is very likely a backbone failure.  In the US you can be quite certain that in the case of a backbone failure there are already lots of people aware of the problem and working on it.

There is no way to ‘re-route’ your personal traffic.  The Internet is designed to route traffic where it can, and if you traffic does not get through it is because there is no place for it to go.


How to Purchase NeoTrace

NeoTrace is available to individual users as Shareware, and if you use it we encourage you to register it.  If you use it for commercial purposes you are required to register it.  Your registration ensures you that we will be able to continue to update the product and provide you with newer and better versions.

Site licenses for 5 or more users can be purchased inexpensively from NeoWorx or authorized resellers.

Always be sure you have the latest pricing and contact information by visiting our web site.

You may register online, by phone, fax or mail.  Download order forms and view contact information, or use our online registration system, by visiting our home page:

http://www.neoworx.com


Copyright

NeoTrace Copyright 1997-1999 NeoWorx inc.  All Rights Reserved.

NeoTrace is not public domain software, nor is it free software.


License Agreement

Shareware License

FOR DISTRIBUTION OF SHAREWARE FILES, USER GROUPS, BBS's, ONLINE SERVICES, SHAREWARE VENDORS, and OTHERS

A limited license is granted to copy and distribute our shareware software only for the trial use of others, subject to the following limitations:

1)    The software must be copied in unmodified form, complete with the file containing this license information.

2)    The full machine-readable documentation must be included with each copy.

3)    Our software may not be distributed in conjunction with any other product without a specific license to do so from NeoWorx inc.

4)    Vending of our software products in retail stores (by "shareware rack vendors") is specifically prohibited without prior written authorization.

5)    No fee, charge, or other compensation may be requested or accepted, except for a nominal disk duplication fee not to exceed two dollars.

License Agreement

NeoWorx inc. warrants that it is sole owner of the software and has full power and authority to grant this license herein without consent of any other party.

This software is licensed, not sold.  The fee you pay entitles you to use the software, not to own it.

The software contained in this package (hereafter referred to as "the Software") is copyrighted material owned by NeoWorx inc.  Payment of the single copy license fee authorizes one named person to use the Software on one computer provided this copyright is not violated and provided the rules outlined herein are observed.

One person may use the Software on any single computer. This license can not be transferred. You must pay for additional copies of the Software if more than one person uses it at one time, or if the Software is used on two or more computers. Neither concurrent use on two or more computers, nor use by more than a single individual on a network is permitted without authorization and payment of other license fees.

You may make copies of the software for backup purposes, as long as all such copies, along with the original, are kept in your possession or control.

You may not make any changes or modifications to the Software, including, but not limited to, de-compiling, disassembling, or otherwise reverse engineering it.  You may not rent or lease it to others.  You may not use it on a computer network if more than one user can use it on more than one computer during any one twenty-four hour span of time.

NeoWorx hereby disclaims all warranties relating to this software, whether express or implied, including without limitation any implied warranties of merchantability or fitness for a particular purpose. NeoWorx will not be liable for any special, incidental, consequential, indirect or similar damages due to loss of data or any other reason, even if NeoWorx or an agent of NeoWorx has been advised of the possibility of such damages.  In no event shall NeoWorx’s liability for any damages ever exceed the price paid for the license to use the software, regardless of the form of the claim.  The person using the software bears all risk as to the quality and performance of the software.

U.S. GOVERNMENT RESTRICTED RIGHTS

Use, duplication, or disclosure by the Government is subject to standard shrink-wrapped software restrictions.

Disclaimer of Warranty

THIS SOFTWARE AND THE ACCOMPANYING FILES ARE SOLD "AS IS" AND WITHOUT WARRANTIES AS TO PERFORMANCE OR MERCHANTABILITY OR ANY OTHER WARRANTIES WHETHER EXPRESSED OR IMPLIED. NO WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE IS OFFERED.