Traceroute

How Traceroute Works

Traceroute exploits the IP TTL (Time to Live)A field in an IP packet header that limits the packet's lifespan by specifying the maximum number of hops it can traverse. Each router decrements the TTL by one; when it reaches zero, the packet is discarded to prevent routing loops. field. It sends a series of probe packets — typically UDP datagrams or ICMP echo requests depending on the OS — with TTL values starting at 1 and incrementing by 1 each round. Each RouterA network device that forwards data packets between different networks by examining destination IP addresses and consulting its routing table. Routers operate at Layer 3 (Network) of the OSI model. along the path decrements the TTL; when TTL hits zero, the router drops the packet and returns an ICMP Time Exceeded message to the source. Traceroute captures the source IP of each Time Exceeded message, revealing each router's address.

By default, traceroute sends three probes per hop, reporting three round-trip times. Asterisks (* * *) appear when a router does not send Time Exceeded messages — a common behavior for routers that deprioritize ICMP responses under load.

Interpreting the Output

Each line in traceroute output represents one HopOne segment of a network path between a source and destination, representing the passage of a packet through a single router or intermediate device. The total number of hops affects latency and is visible via traceroute.. Hostnames, IP addresses, and round-trip times tell you where packets are going and how long each segment takes. A sudden jump in latency between two consecutive hops indicates where delay is being introduced — often a transatlantic or transpacific fiber link.

Asymmetric routing is common on the internet — return packets may take a completely different path, so traceroute only shows the forward path.

Windows vs. Unix Variants

Unix systems use traceroute (UDP by default). Windows uses tracert (ICMP by default). The mtr tool combines ping and traceroute into a continuous real-time display. Many firewalls block UDP probes, so ICMP or TCP modes often yield better results. Use Ping Test for simpler latency measurement to a single target.