Traceroute is a command-line utility that maps the route packets take from a source device to a destination on the internet, displaying each intermediate router (hop) and the round-trip time to reach it. It helps diagnose network connectivity issues by identifying where delays or failures occur along the path.
When you run traceroute to a website or server, it sends a series of packets with incrementally increasing Time-to-Live (TTL) values. Each router along the path decrements the TTL by one. When the TTL reaches zero, the router drops the packet and sends back an ICMP "Time Exceeded" message. Traceroute uses these responses to build a list of hops and measure response times.
For example, running traceroute google.com on a Linux or macOS terminal returns a list of routers between your computer and Google's servers. Each line shows the hop number, hostname (if available), IP address, and latency in milliseconds. The final hop typically corresponds to the target server.
Traceroute relies on the TTL field in the IP header. Every IP packet includes a TTL value that starts at a default of 64 or 128. Each router that forwards the packet reduces the TTL by one. When the TTL reaches zero, the router discards the packet and sends an ICMP error message back to the sender.
Traceroute begins by sending three packets with TTL=1. The first router drops them and replies with "Time Exceeded." The sender records the IP address and round-trip time. It then sends three packets with TTL=2, and so on, until the destination is reached or the maximum number of hops (usually 30) is exceeded.
Once the packet reaches the destination, the final router may respond with an ICMP "Echo Reply" instead of "Time Exceeded," signaling that the path is complete. This allows traceroute to stop and report the full path.
Traceroute displays the sequence of routers between your device and the target. Each hop provides the IP address and round-trip time. Latency spikes at specific hops often indicate congestion, slow links, or routing inefficiencies.
For instance, a trace to 172.217.169.174 (Google's IP) might show:
1 192.168.1.1 (local gateway) 1.2 ms 1.1 ms 1.3 ms
2 10.10.1.1 (ISP router) 5.4 ms 5.6 ms 5.2 ms
3 100.64.1.1 (regional core) 12.8 ms 13.1 ms 12.9 ms
4 203.0.113.1 (transit provider) 28.3 ms 27.9 ms 28.1 ms
5 172.217.169.174 35.2 ms 34.8 ms 35.1 ms
This output shows the packet traveled through five hops. The jump from 13ms to 28ms at hop 4 suggests a bottleneck in the transit network. The final hop at 35ms confirms the destination is reachable.
Some hops may return asterisks (*) instead of times. This means the router did not respond-either because it blocks ICMP traffic or because the packet was dropped due to high load. A consistent pattern of * at a single hop often indicates intentional filtering, common in enterprise networks or cloud providers.
Traceroute does not show the actual physical path. Routers may forward packets via different routes based on load balancing or policy, so multiple runs can yield slightly different paths. The displayed route is a snapshot of one packet's process, not a guaranteed constant.
Many firewalls and routers filter ICMP packets. If a hop doesn't respond, it doesn't mean the network is down-it may simply be configured to ignore traceroute probes. Some services, like AWS EC2 instances, drop ICMP by default unless explicitly enabled.
Traceroute cannot detect application-layer problems. It only tests basic IP connectivity. A successful trace does not guarantee that a web service, email server, or database is functioning. For deeper checks, tools like ping, curl, or telnet are needed.
Network administrators use traceroute to isolate performance bottlenecks. If a user reports slow access to a corporate server, a trace can reveal whether the delay occurs within the local network, the ISP, or beyond.
I once traced a connection issue to a remote office's internet gateway. The trace showed consistent 150ms delays at hop 12, which was a regional ISP router. After contacting the provider, we discovered a misconfigured QoS rule was throttling outbound traffic. Correcting the rule reduced latency to under 20ms.
Developers use traceroute during deployment testing. Before launching a new API endpoint, teams trace the path to ensure packets reach the intended region. If a trace shows a detour through a distant data center, it may indicate suboptimal DNS resolution or routing policies.
For home users, traceroute helps diagnose intermittent disconnections. A sudden spike in latency at a particular hop can signal a failing link or temporary congestion. Repeated timeouts suggest a problem with the ISP or upstream provider.
While traceroute maps the path, ping measures round-trip time to a single destination. Ping tells you if a host responds, but not the route taken. Traceroute shows the entire process.
Another tool, mtr (My Trace Route), combines ping and traceroute into a continuous live display. It updates results every second, making it ideal for monitoring unstable connections. Unlike static traceroute, mtr shows real-time changes in latency and packet loss.
On Windows, the equivalent command is tracert. It functions identically but uses different syntax and sometimes shows less detailed output. Both tools rely on ICMP or UDP packets depending on the OS implementation.
| Tool | Protocol Used | Output Type | Best For |
|---|---|---|---|
| traceroute | ICMP or UDP | Static path map | One-time diagnosis |
| tracert (Windows) | ICMP | Static path map | Windows troubleshooting |
| mtr | ICMP | Live, changing update | Monitoring unstable connections |
A non-obvious fact: traceroute uses UDP by default on Unix-like systems, but switches to ICMP on some platforms. This affects whether the target responds. Some networks block UDP but allow ICMP, leading to inconsistent results. Always test with both protocols if possible.
According to the Internet Engineering Task Force (IETF), traceroute is documented in RFC 1393 and later updated in RFC 7881. These standards define the behavior and expected responses for diagnostic tools in IP networks.
The National Institute of Standards and Technology (NIST) recognizes traceroute as a foundational tool in network fault isolation. Its use is recommended in federal agency IT operations for diagnosing connectivity issues across distributed systems.
Understanding what traceroute does enables faster troubleshooting of network problems. It reveals hidden bottlenecks, identifies routing anomalies, and confirms whether a destination is reachable. While not a fix itself, it's essential for narrowing down the root cause of connectivity issues.