About traceroute...
I think traceroute relies on a icmp message "expired in transit" returned by
each host on the route with increasing TTL on each probe.
I am not shure that encap tunnels are able to provide such behavior.
By looking to the traces, the "expired" icmp message is sent to the public
tunnel endpoint IP from the machine where the TTL expires, but it is not
encapsulated so does not make it to back to the traceroute utility.
This could be a linux-only behavior, never tried it on nos derivatives...
Marius.