tracert (traceroute)

In short: A command that shows the path of data packets to a destination across all routers (hops) with the round-trip time at each station.

In more detail: tracert (Windows) or traceroute (Linux/macOS) uses the TTL (time to live) field in the IP header. Each router lowers it by 1; at 0 it discards the packet and reports Time Exceeded back (ICMP). This is how you get to know the routers on the path.

In Depth

How it works

tracert sends packets with TTL 1, 2, 3 and so on. The first packet fails at the first router, which reports back, the second at the second one and so on, until the destination answers. Three measurements are shown per station.

Example output

  1    <1 ms    <1 ms    <1 ms  fritz.box [192.168.178.1]
  2     9 ms     8 ms     9 ms  p-gw.provider.de [62.x.x.x]
  3    11 ms    11 ms    12 ms  core1.provider.de [80.x.x.x]
  4     *        *        *     Request timed out.
  5    13 ms    12 ms    13 ms  76.76.21.21

How to read the output

• Jumps in latency: That is probably where the bottleneck is (long distance, congestion).
• * * *: The station does not answer ICMP. Often just a firewall; if the destination is reachable afterwards the path is fine anyway.
• Break-off at the end: From here nothing arrives; the fault or the destination’s firewall is there.
• Many hops: 8 to 20 stations are normal.

Options

Option	Effect
-d	no name resolution, faster
-h 30	maximum number of hops
-w 1000	wait time per reply in milliseconds

Differences between systems

Windows sends ICMP echo requests, traceroute on Linux uses UDP packets by default (-I for ICMP). pathping combines tracert with a longer measurement and shows packet loss per hop; on Linux mtr does that.

See also: Network Commands in the CMD, ICMP, Time Exceeded, Router, Ping, IPv4, Latency, TCP/IP Model