Detecting sources of computer network failures

1. A method comprising:

identifying a network flow of packets in a computer network between a source and a destination, wherein the network flow corresponds to a particular path in the computer network between the source and the destination, the particular path being defined in part by the source and destination identifiers and comprising a plurality of network components including one or more network devices coupled by one or more links; and

in response to a determination that there is no end-to-end connectivity between the source and the destination along the particular path, determining whether a network component of the particular path in the network flow has failed comprising:

requesting that the source transmit a respective trace diagnostic packet to each network device along the same particular path of the network flow, wherein each trace diagnostic packet is configured to follow the particular path of the network flow and has a particular value in a time-to-live field such that the trace diagnostic packet will expire at a different network device in the particular path, which causes a corresponding network device to send a time exceeded message in response to that trace diagnostic packet, and a packet identifier inserted into a field located within a first plurality of bytes of the trace diagnostic packet, and wherein the time exceeded message includes a portion of the trace diagnostic packet that includes the packet identifier inserted into the first plurality of bytes of the trace diagnostic packet; and

determining whether at least one network component that is part of the particular path of the network flow has failed based on results of the trace diagnostic packets.

2. The method of claim 1 , wherein determining whether at least one network component has failed comprises:

determining whether the source has received a time exceeded message from a particular network device;

in response to determining that the source has received the time exceeded message from a particular network device, determining that the particular network device is operational from the source along the particular path; and

in response to determining that the source has not received the time exceeded message from a particular network device, determining that the particular network device has failed from the source along the particular path.

3. The method of claim 1 , wherein the packet identifier of the trace diagnostic packet is inserted within a sequence number field of a TCP packet.

4. The method of claim 1 , wherein the packet identifier of the trace diagnostic packet is inserted within a length field of a UDP packet.

5. The method of claim 1 , wherein the time exceeded message is an internet control message protocol message that contains a collection of bits of the trace diagnostic packet that triggered the time exceeded message.

6. The method of claim 1 , wherein the time-to-live field of the trace diagnostic packet includes an integer number that is decremented at each network device along the particular path of the network flow such that the time exceeded message is sent by the network device when the integer number is decremented to zero.

7. The method of claim 1 , wherein the determination that there is no end-to-end connectivity between the source and the destination comprises:

performing a first probe to determine whether there is end-to-end connectivity between the source and the destination including requesting that the source transmit an end-to-end diagnostic packet to the destination, wherein the end-to-end diagnostic packet includes information comprising a source identifier field and a destination identifier field that include identifiers for the source and destination, respectively, that match the packets in the network flow between the source and destination such that one or more network devices in the computer network forward the end-to-end diagnostic packet on the particular path of the network flow.

8. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

identifying a network flow of packets in a computer network between a source and a destination, wherein the network flow corresponds to a particular path in the computer network between the source and the destination, the particular path being defined in part by the source and destination identifiers and comprising a plurality of network components including one or more network devices coupled by one or more links; and

in response to a determination that there is no end-to-end connectivity between the source and the destination along the particular path, determining whether a network component of the particular path in the network flow has failed comprising:

requesting that the source transmit a respective trace diagnostic packet to each network device along the same particular path of the network flow, wherein each trace diagnostic packet is configured to follow the particular path of the network flow and has a particular value in a time-to-live field such that the trace diagnostic packet will expire at a different network device in the particular path, which causes a corresponding network device to send a time exceeded message in response to that trace diagnostic packet, and a packet identifier inserted into a field located within a first plurality of bytes of the trace diagnostic packet, and wherein the time exceeded message includes a portion of the trace diagnostic packet that includes the packet identifier inserted into the first plurality of bytes of the trace diagnostic packet; and

determining whether at least one network component that is part of the particular path of the network flow has failed based on results of the trace diagnostic packets.

9. The system of claim 8 , wherein determining whether at least one network component has failed comprises:

determining whether the source has received a time exceeded message from a particular network device;

in response to determining that the source has received the time exceeded message from a particular network device, determining that the particular network device is operational from the source along the particular path; and

in response to determining that the source has not received the time exceeded message from a particular network device, determining that the particular network device has failed from the source along the particular path.

10. The system of claim 8 , wherein the packet identifier of the trace diagnostic packet is inserted within a sequence number field of TCP packet.

11. The system of claim 10 , wherein the packet identifier of the trace diagnostic packet is inserted within a length field of a UDP packet.

12. The system of claim 8 , wherein the time exceeded message is an internet control message protocol message that contains a collection of bits of the trace diagnostic packet that triggered the time exceeded message.

13. The system of claim 8 , wherein the time-to-live field of the trace diagnostic packet includes an integer number that is decremented at each network device along the particular path of the network flow such that the time exceeded message is sent by the network device when the integer number is decremented to zero.

14. The system of claim 8 , wherein the determination that there is no end-to-end connectivity between the source and the destination comprises:

performing a first probe to determine whether there is end-to-end connectivity between the source and the destination including requesting that the source transmit an end-to-end diagnostic packet to the destination, wherein the end-to-end diagnostic packet includes information comprising a source identifier field and a destination identifier field that include identifiers for the source and destination, respectively, that match the packets in the network flow between the source and destination such that one or more network devices in the computer network forward the end-to-end diagnostic packet on the particular path of the network flow.

15. One or more non-transitory computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:

identifying a network flow of packets in a computer network between a source and a destination, wherein the network flow corresponds to a particular path in the computer network between the source and the destination, the particular path being defined in part by the source and destination identifiers and comprising a plurality of network components including one or more network devices coupled by one or more links; and

in response to a determination that there is no end-to-end connectivity between the source and the destination along the particular path, determining whether a network component of the particular path in the network flow has failed comprising:

requesting that the source transmit a respective trace diagnostic packet to each network device along the same particular path of the network flow, wherein each trace diagnostic packet is configured to follow the particular path of the network flow and has a particular value in a time-to-live field such that the trace diagnostic packet will expire at a different network device in the particular path, which causes a corresponding network device to send a time exceeded message in response to that trace diagnostic packet, and a packet identifier inserted into a field located within a first plurality of bytes of the trace diagnostic packet, and wherein the time exceeded message includes a portion of the trace diagnostic packet that includes the packet identifier inserted into the first plurality of bytes of the trace diagnostic packet; and

determining whether at least one network component that is part of the particular path of the network flow has failed based on results of the trace diagnostic packets.

16. The non-transitory computer storage media of claim 15 , wherein determining whether at least one network component has failed comprises:

determining whether the source has received a time exceeded message from a particular network device;

in response to determining that the source has received the time exceeded message from a particular network device, determining that the particular network device is operational from the source along the particular path; and

in response to determining that the source has not received the time exceeded message from a particular network device, determining that the particular network device has failed from the source along the particular path.

17. The non-transitory computer storage media of claim 15 , wherein the packet identifier of the trace diagnostic packet is inserted within a sequence number field of a TCP packet.

18. The non-transitory computer storage media of claim 17 , wherein the packet identifier of the trace diagnostic packet is inserted within a length field of a UDP packet.

19. The non-transitory computer storage media of claim 15 , wherein the time exceeded message is an internet control message protocol message that contains a collection of bits of the trace diagnostic packet that triggered the time exceeded message.

20. The non-transitory computer storage media of claim 15 , wherein the time-to-live field of the trace diagnostic packet includes an integer number that is decremented at each network device along the particular path of the network flow such that the time exceeded message is sent by the network device when the integer number is decremented to zero.

21. The non-transitory computer storage media of claim 15 , wherein the determination that there is no end-to-end connectivity between the source and the destination comprises:

performing a first probe to determine whether there is end-to-end connectivity between the source and the destination including requesting that the source transmit an end-to-end diagnostic packet to the destination, wherein the end-to-end diagnostic packet includes information comprising a source identifier field and a destination identifier field that include identifiers for the source and destination, respectively, that match the packets in the network flow between the source and destination such that one or more network devices in the computer network forward the end-to-end diagnostic packet on the particular path of the network flow.