Traceroute: Following a packet’s path

In short: A tool that shows which routers a data packet passes on its way from your computer to a destination and how long each section takes.

In more detail: Traceroute (tracert on Windows) sends packets with a gradually increased lifetime (TTL). Each router that discards a packet because its TTL has expired reports back via ICMP and thereby reveals its address. The replies produce a list of intermediate stations (“hops”) with their round-trip times.

In Depth

How it works

Every IP packet carries a TTL (time to live) field. Each router subtracts 1; when the value reaches 0, the router drops the packet and sends an ICMP “Time Exceeded” message back to the sender. Traceroute exploits this: the first packet gets TTL 1 and ends at the first router, the second gets TTL 2 and ends at the second router, and so on until the destination is reached. Usually three packets are sent per step, hence the three times per line.

Example and output

traceroute example.com
 1  fritz.box (192.168.178.1)   1.2 ms   1.0 ms   1.1 ms
 2  10.20.0.1                  9.8 ms   9.5 ms   9.9 ms
 3  * * *
 4  core1.provider.net        14.2 ms  14.0 ms  14.4 ms

Lines with * * * only mean that no reply came from that hop. This is often harmless, because many routers and firewalls do not answer such requests but still forward the traffic.

What you read from it

If the time jumps up sharply at one point and stays high afterwards, the slow section is often there (for example an overseas link). If it rises in a single line only and then falls again, that router simply generated its reply slowly. The return path can differ from the outbound path, so traceroute only says something about one direction.

Variants

On Linux and macOS the classic variants send UDP packets, on Windows ICMP echo. With traceroute -T (TCP) or -I (ICMP) another protocol can be chosen if firewalls block the default method. mtr combines ping and traceroute and continuously shows loss and latency per hop.

See also: ICMP, Ping, Routing, IP addresses