Traceroute
In short
Traceroute is a network diagnostic tool that lists every router a packet passes through on its way to a destination, along with the delay to reach each one.
What is traceroute?
Traceroute is a command-line tool that maps the path packets take from your computer to a destination, such as a web server. It prints one line per hop, meaning each router along the way, with that router's address and how long it took to respond. On Windows the same tool is called tracert, and many Linux systems also include tracepath, which gives similar output without administrator rights.
Traceroute works by making clever use of the time-to-live (TTL) field in every IP packet. Each router lowers the TTL by one and, when it reaches zero, drops the packet and sends back an ICMP time exceeded message that reveals the router's address. Traceroute first sends packets with a TTL of 1, which the first router rejects, then a TTL of 2, which gets one hop further, and so on until the destination itself answers. It sends three probes per hop by default, so each line shows three timings, and a * means no reply arrived in time.
It is like mapping a delivery route by sending out couriers who are told to stop after one, two, then three stops and phone home from wherever they end up. Traceroute helps you find where a connection breaks or slows down, for example to tell whether a problem is in your own network, at your internet provider, or near the destination. Tools such as mtr combine traceroute and ping and keep probing continuously, which makes intermittent packet loss easier to spot.
Traceroute is often confused with ping. Ping measures the round trip to one destination, while traceroute breaks the path into hops and measures each one. Its output also needs careful reading: many routers give probes low priority or ignore them entirely, so a hop showing * or a high delay is not a problem as long as later hops look normal. And the path you see is only the outbound one, because replies may return by a different route.
Key takeaways
- Traceroute lists each router hop between you and a destination, with the delay to each.
- It sends packets with increasing TTL values and reads the ICMP time exceeded replies.
- On Windows the command is
tracert; Linux also offerstracepathandmtr. - A
*means a hop didn't answer, which is usually harmless if later hops respond. - Ping measures the whole trip to one host, while traceroute breaks it down hop by hop.
Example
# Trace the route to a host (Windows: tracert example.com)
traceroute example.com
# 1 192.168.1.1 1.2 ms 1.0 ms 1.1 ms <- your home router
# 2 10.64.0.1 8.4 ms 8.1 ms 8.9 ms <- internet provider
# 3 * * * <- this router ignores probes
# 4 203.0.113.9 14.7 ms 14.2 ms 15.0 ms
# 5 203.0.113.80 15.1 ms 14.9 ms 15.3 ms <- the destination
# Skip reverse DNS lookups and use ICMP probes (needs root)
sudo traceroute -n -I example.com
# Continuous traceroute with ping statistics for every hop
mtr example.comReaders ask
What does an asterisk mean in traceroute output?
A * means no reply came back from that hop before the timeout. Many routers are configured to ignore or rate-limit traceroute probes, so stars in the middle of a path are usually harmless if the later hops and the destination respond.
What is the difference between traceroute and tracert?
They are the same idea with different names and defaults. tracert on Windows sends ICMP echo requests, while traceroute on Linux and macOS sends UDP probes by default and can switch to ICMP or TCP with options.
How does traceroute work?
It sends packets with a TTL of 1, then 2, then 3, and so on. Each router that lowers a packet's TTL to zero drops it and returns an ICMP time exceeded message, which reveals that router's address and the delay to reach it.
See also
- PingNetworking, p. 21Ping is a network utility that checks whether a host is reachable by sending it small ICMP echo requests and measuring how long each reply takes to return.
- RouterNetworking, p. 25A router is a networking device that forwards packets between different networks, choosing the next hop for each one based on its destination IP address.
- LatencyNetworking, p. 14Latency is the delay between sending a request and the start of a response, usually measured in milliseconds, and it shapes how responsive an app feels.
- PacketNetworking, p. 20A packet is a small, formatted unit of data sent across a network, made of a header with addressing information and a payload that carries the actual data.
- IP AddressNetworking, p. 10An IP address is a numeric label assigned to each device on a network so that data can be routed to it, much like a postal address for a house.
- DNSDevOps & Cloud, p. 16DNS is the internet's naming system that translates human-readable domain names like example.com into the numeric IP addresses computers use to connect.
- TTLNetworking, p. 34TTL (time to live) is a limit on how long data stays valid: router hops left for an IP packet, or seconds a DNS or cached answer may be reused.
Spotted a mistake or something missing on this page?Suggest an edit