Traceroute

What traceroute is

Traceroute is a diagnostic that reveals the path packets take from one host to another. It relies on the TTL field of IP packets: every router decreases it by one, and a router that brings it to zero drops the packet and sends back an ICMP "time exceeded" message. Traceroute sends a probe with TTL 1 and records which router answered, then TTL 2, then TTL 3, and so on until a probe reaches the destination. The output is one line per hop with the router's address, its reverse DNS name if it has one, and the round-trip time of each probe, usually three per hop.

Implementations differ in the probes they send: UDP packets to high ports on Unix, ICMP echo requests on Windows (tracert), and TCP SYN packets in tools meant to pass firewalls. The mechanism is the same.

Reading the output

• Rising latency along the path is normal; a large jump between two hops marks a long link, often an undersea cable or a continent change.
• An asterisk means no reply within the timeout. Many routers rate-limit or ignore ICMP, so a few silent hops in the middle are not a problem as long as later hops respond.
• The hostnames often encode locations and roles, for example airport codes or city names, which makes a route readable even without a map.
• A destination that never answers may still be reachable; some hosts drop everything but the services they offer.

Why it matters

Traceroute shows where a connection slows down or fails: inside your own network, at your ISP, at an exchange point, or at the far end. For proxy and VPN users it has a second use. A trace to a nearby site that first travels to another country reveals the tunnel's exit location, and a trace from a server toward your proxy shows the hops behind the exit, which sometimes expose the provider renting the address.

How to check

The traceroute tool runs a trace from our measurement node to any address or hostname and lists every hop with its network and location. Because the trace starts at our node rather than at your computer, it shows the path from our vantage point; for the path from your own machine, run traceroute or tracert locally and compare. The ping tool gives the end-to-end round-trip time without the per-hop detail.

A common misconception

The hops shown are the routers that replied. Asymmetric routing is common, so the reverse direction can take a different route, and a slow hop in the middle does not always mean that hop is the problem.