i use the ip address from the test of home , to do the test inversely: Tracing route to rrcs-nyc-24-136-114-1.biz.rr.com [24.136.114.1] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms mudd-edge-1-vlan236-5.net.columbia.edu [128.59.51.1] 2 7 ms 1 ms 1 ms nyser-gw.net.columbia.edu [128.59.1.4] 3 208 ms 204 ms 210 ms 67.99.58.193 4 222 ms 207 ms 186 ms 216.140.10.29 5 194 ms 202 ms 196 ms pop1-nye-P12-2.atdn.net [66.185.149.201] 6 206 ms 191 ms 189 ms bb1-nye-P0-0.atdn.net [66.185.151.48] 7 205 ms 201 ms 208 ms bb2-new-P5-0.atdn.net [66.185.152.197] 8 216 ms 218 ms 219 ms pop2-new-P1-0.atdn.net [66.185.137.19] 9 225 ms 218 ms 217 ms rr-manhattan.atdn.net [66.185.137.22] 10 197 ms 198 ms 203 ms pos2-0-nycmnya-rtr1.nyc.rr.com [24.29.101.254] 11 213 ms 214 ms 217 ms 24.29.97.26 12 196 ms 203 ms 200 ms pos2-0.nycmnyg-rtr1.nyc.rr.com [24.29.98.6] 13 187 ms 202 ms 201 ms pos2-0.nycmnyg-rtr2.nyc.rr.com [24.29.101.202] 14 213 ms 208 ms 208 ms rrcs-nyc-24-136-114-1.biz.rr.com [24.136.114.1] Trace complete. from these two tracert results( compare with the trace from home), i believe 67.99.58.193 connects to 67.99.58.194, which on the tracert from home; and also 216.140.10.29 connects with 216.140.10.30, untile 24.29.98.6 connects with 24.29.98.5. for i already know the TOS will lose when send packet from home to bart.cs.columbia.edu, i did the test from bart to the gateway of home this time. Use the gateway because the home ip address is 192.168.X.X , which i believe using NAT. And when packet pass NAT, seems the TOS bits will lose , see the file nat.txt for detail. and what is interesting is when i use 0x04 as TOS bits, it lost, and when i use 0x06, it changed to 0x02 in the reply packet: : bart.cs.columbia.edu ;ping -P 0x06 24.136.114.1 24.136.114.1 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 15:26:03.382204 128.59.19.191 > 24.136.114.1: icmp: echo request (DF) [tos 0x6,ECT(0)] (ttl 255, id 58117, len 84) 15:26:03.571028 24.136.114.1 > 128.59.19.191: icmp: echo reply (DF) [tos 0x2,ECT(0)] (ttl 246, id 58117, len 84) changed to 0x02 //------------------------------------------------------ : bart.cs.columbia.edu ;ping -P 0x04 24.136.114.1 24.136.114.1 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 15:27:58.518353 128.59.19.191 > 24.136.114.1: icmp: echo request (DF) [tos 0x4] (ttl 255, id 58118, len 84) 15:27:58.725531 24.136.114.1 > 128.59.19.191: icmp: echo reply (DF) (ttl 246, id 58118, len 84) lost its TOS bits //--------------------------------------------------- and this begin from the third node , which is 67.99.58.193, rihgt after the commodity (nyser-gw) gateway[128.59.1.4], while 128.59.1.4 will lose all the TOS bits in the reply packet. Tracing route to 67.99.58.193 over a maximum of 30 hops 1 <1 ms <1 ms <1 ms mudd-edge-1-vlan236-5.net.columbia.edu [128.59.51.1] 2 <1 ms <1 ms <1 ms nyser-gw.net.columbia.edu [128.59.1.4] 3 222 ms 220 ms 223 ms 67.99.58.193 Trace complete. : bart.cs.columbia.edu ;ping -P 0x06 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:33:30.604613 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x6,ECT(0)] (ttl 255, id 22634, len 84) 14:33:30.808545 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) [tos 0x2,ECT(0)] (ttl 253, id 55658, len 84) which interestingly return TOS 0x2. //---------------------------------------------- then i try other TOS like 0x05,0x07 . . : bart.cs.columbia.edu ;ping -P 0x05 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:49:50.062083 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x5,ECT(1)] (ttl 255, id 22644, len 84) 14:49:51.277134 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) [tos 0x1,ECT(1)] (ttl 253, id 1019, len 84) change to 0x1 //------------------------------------------------------ : bart.cs.columbia.edu ;ping -P 0x07 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:43:03.541778 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x7,CE] (ttl 255, id 22643, len 84) 14:43:03.763115 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) [tos 0x3,CE] (ttl 253, id 62670, len 84) change to 0x3 //-------------------------------------------------- : bart.cs.columbia.edu ;ping -P 0x09 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:56:06.166704 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x9,ECT(1)] (ttl 255, id 4203, len 84) 14:56:06.381436 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) [tos 0x1,ECT(1)] (ttl 253, id 4492, len 84) change to 0x1 while when the TOS is 0x04 or 0x08, it will lose. : bart.cs.columbia.edu ;ping -P 0x08 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:35:14.309051 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x8] (ttl 255, id 22635, len 84) 14:35:14.529158 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) (ttl 253, id 57008, len 84) //---------------------------------------------------- : bart.cs.columbia.edu ;ping -P 0x04 67.99.58.193 67.99.58.193 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:38:00.757043 128.59.19.191 > 67.99.58.193: icmp: echo request (DF) [tos 0x4] (ttl 255, id 22636, len 84) 14:38:00.958743 67.99.58.193 > 128.59.19.191: icmp: echo reply (DF) (ttl 253, id 59111, len 84) //-------------------------------------------------------------------------------------------------- and i changed the value of TOS to test the the commodity (nyser-gw) gateway[128.59.1.4], it will lose the bits no matter what the value is. : bart.cs.columbia.edu ;ping -P 0x07 128.59.1.4 128.59.1.4 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:47:10.645822 128.59.19.191 > 128.59.1.4: icmp: echo request (DF) [tos 0x7,CE] (ttl 255, id 18112, len 84) 14:47:10.647357 128.59.1.4 > 128.59.19.191: icmp: echo reply (DF) (ttl 254, id 18112, len 84) lost the TOS bits, while the next node after the commodity gateway will return different TOS back , which is 0x03 if send out 0x07. //----------------------------------------------- to verify it, i pick up another route which pass the commodity (nyser-gw) gateway, for example , www.google.com. the route is : Tracing route to www.google.akadns.net [216.239.39.99] over a maximum of 30 hops: 1 7 ms 4 ms 43 ms butl-edge-1-vlan38-1.net.columbia.edu [128.59.152.1] 2 <1 ms <1 ms <1 ms nyser-gw.net.columbia.edu [128.59.1.4] 3 2 ms 5 ms 4 ms 67.99.58.193 4 6 ms 5 ms 3 ms P2-2.c0.nwyk.broadwing.net [216.140.10.13] 5 5 ms 5 ms 5 ms p7-0.c0.wash.broadwing.net [216.140.8.101] 6 6 ms 5 ms 5 ms p0-2-0.a1.wash.broadwing.net [216.140.8.90] 7 6 ms 6 ms 6 ms 216.140.8.78 8 6 ms 6 ms 6 ms sl-st21-ash-4-2.sprintlink.net [144.223.246.81] 9 6 ms 6 ms 6 ms bpr2-so-3-0-0.VirginiaEquinix.cw.net [208.173.50.165] 10 6 ms 6 ms 6 ms cpr1-pos-9-0.VirginiaEquinix.cw.net [206.24.227.69] 11 7 ms 9 ms 7 ms bhr1-pos-0-0.Sterling1dc2.cw.net [208.173.52.38] 12 44 ms 8 ms 8 ms csr11-ve242.Sterling2dc3.cw.net [216.109.66.99] 13 7 ms 8 ms 7 ms 218-google-exodusdc.exodus.net [216.109.88.218] 14 12 ms 16 ms 13 ms 216.239.47.46 15 7 ms 7 ms 8 ms 216.239.39.99 Trace complete. we could notice that, it also use 67.99.58.193 as the third hop , which will return different TOS value in the reply packet. now , we check when it lost all the TOS , means do not reply any TOS bits in the packet. : bart.cs.columbia.edu ;ping -P 0x06 216.140.8.90 216.140.8.90 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 15:09:14.727091 128.59.19.191 > 216.140.8.90: icmp: echo request (DF) [tos 0x6,ECT(0)] (ttl 255, id 32497, len 84) 15:09:14.947165 216.140.8.90 > 128.59.19.191: icmp: echo reply (DF) [tos 0x2,ECT(0)] (ttl 250, id 55533, len 84) seems it still carry the bits on its sixth hop. //---------------------------------------------------- : bart.cs.columbia.edu ;ping -P 0x06 216.140.8.78 216.140.8.78 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 14:59:30.824712 128.59.19.191 > 216.140.8.78: icmp: echo request (DF) [tos 0x6,ECT(0)] (ttl 255, id 30262, len 84) 14:59:31.055716 216.140.8.78 > 128.59.19.191: icmp: echo reply (DF) (ttl 249, id 30262, len 84) lose the TOS bits at the seventh hop, and any nodes behind it, lose the bits too. : bart.cs.columbia.edu ;ping -P 0x06 144.223.246.81 144.223.246.81 is alive : bart.cs.columbia.edu ; : bart.cs.columbia.edu ;tcpdump -n -v -v 15:12:51.327244 128.59.19.191 > 144.223.246.81: icmp: echo request (DF) [tos 0x6,ECT(0)] (ttl 255, id 22740, len 84) 15:12:51.546725 144.223.246.81 > 128.59.19.191: icmp: echo reply (DF) (ttl 248, id 22740, len 84)