01 // DEFINITION
What Is Traceroute?
Traceroute is a network diagnostic utility that maps the path packets take from your device to a target host — revealing every router (hop) along the route and the round-trip time (latency) to each one. By sending probe packets with incrementally increasing TTL values, it forces each router to announce itself.
TTL
Time To Live field drives discovery
ICMP
Router responses via control messages
3×
Probes sent per hop for accuracy
02 // TTL MECHANICS
How TTL Works — Hop by Hop
Each packet carries a TTL counter. Every router that forwards the packet decrements TTL by 1. When TTL hits zero, the router discards the packet and fires back an ICMP Time Exceeded message — revealing its identity and location.
R1
Gateway Router
TTL→0 ✗
DST
Destination Host
REACHED ✓
Each probe run starts TTL at 1 and increments. Probe 1 expires at hop 1, probe 2 at hop 2 — building the full route map one hop at a time.
03 // ICMP PROTOCOL
Router Responses — ICMP Message Types
Traceroute relies on two ICMP message types to discover the path and detect the destination:
| ICMP Type |
Code |
Meaning |
Sent By |
| Time Exceeded |
Type 11, Code 0 |
TTL expired in transit — router reveals itself |
Intermediate routers |
| Port Unreachable |
Type 3, Code 3 |
Destination reached — no listener on probe port |
Destination host (UDP) |
| Echo Reply |
Type 0 |
Destination reached — ICMP ping response |
Destination host (ICMP mode) |
| Filtered / Silent |
N/A |
No response — firewall blocking or rate-limiting |
Appears as * * * |
Unix/Linux traceroute sends UDP probes to high port numbers (33434+) by default. Windows tracert uses ICMP Echo Requests. Both rely on the same TTL/ICMP mechanics.
04 // EXAMPLE OUTPUT
Reading a Traceroute — Annotated
Each line represents one hop. Three RTT measurements are shown (ms). Asterisks indicate no response within the timeout window.
n9lya@workstation:~$ traceroute -n 8.8.8.8
1 192.168.1.xxx 1.2 ms 1.1 ms 1.0 ms // Local gateway
2 10.0.0.1 12.3 ms 11.9 ms 12.1 ms // ISP CMTS
3 68.85.136.1 13.4 ms 13.2 ms 13.6 ms // ISP backbone
4 68.86.90.21 14.1 ms 14.0 ms 14.3 ms // ISP peering
5 * * * // Filtered router
6 72.14.232.85 15.9 ms 16.2 ms 15.8 ms // Google edge
7 142.251.49.93 17.1 ms 17.0 ms 17.3 ms // Google backbone
8 8.8.8.8 18.2 ms 18.1 ms 18.4 ms // DESTINATION ✓ _
05 // TROUBLESHOOTING GUIDE
Common Results — What They Mean
* * *
No Response. Router is dropping ICMP/UDP — firewall policy, rate limiting, or misconfiguration. Packet may still be forwarded; the silence only means no ICMP reply.
High RTT jump
Latency spike at a specific hop. Bottleneck, congested link, or long geographic distance at that segment. Compare RTT stability across subsequent hops.
Repeated IPs
Routing loop detected. The same router appears multiple times — packets are cycling. A BGP/OSPF misconfiguration is likely causing the loop.
Stops early
Host unreachable or packet dropped. Trace ends before destination — the host may be down, filtered by firewall, or a routing blackhole is present.
Asymmetric path
Return path differs. ICMP replies travel a different route than the probes — normal in multi-path BGP environments; RTT values may appear inconsistent across hops.
06 // COMMAND REFERENCE
Syntax & Use Cases
traceroute
[-n]
[-m maxhops]
[-w timeout]
[-I]
<host>
tracert
[-d]
[-h maxhops]
[-w timeout]
<host>
⚡
Latency Analysis
Find exactly which segment is introducing delay — ISP, peering, or destination network.
🔁
Routing Loops
Detect BGP/OSPF misconfigurations causing packets to cycle endlessly.
📡
Packet Loss
Identify loss points by comparing consistency of RTT values hop by hop.
🚧
Firewall Mapping
Locate where packets are being filtered using * * * patterns in the output.
🌐
ISP/WAN Faults
Prove whether a problem lies within your network or upstream at the provider.