11.5 Traceroute

Understanding Traceroute

Traceroute is a diagnostic tool that shows the path that packets take from your device to a destination on a network. While ping mainly tells you whether a host is reachable and how long a round trip takes, traceroute reveals the intermediate routers along the way and where delays or problems may occur.

This chapter focuses on how traceroute works, how to read its output, and what it can and cannot tell you. It relies heavily on concepts from IP and ICMP, but it will not fully re explain those here.

The Goal of Traceroute

When you send traffic across a network, it usually passes through multiple routers before it reaches its destination. If something breaks or slows down, you need to know where. Traceroute answers questions such as:

Where does my traffic go on the way to a server?

Which router is dropping or delaying packets?

Is a problem inside my local network, at my internet provider, or further away?

Traceroute does this by sending a series of probe packets and measuring how long it takes to get responses from each hop, that is, each router on the path.

The Role of TTL in Traceroute

Traceroute relies on the IP header field called Time To Live, commonly written as TTL. TTL is a number that decreases by 1 at each router hop. If TTL reaches 0, the packet is discarded and the router sends an ICMP Time Exceeded message back to the sender.

Traceroute exploits this behavior by sending packets with carefully chosen TTL values.

By controlling the initial TTL, traceroute forces routers along the path to reveal themselves one by one.

How Traceroute Works Step by Step

Traceroute runs in a loop, gradually increasing the TTL of the packets it sends. The basic pattern is:

1. Send probe packets with TTL = 1.
   The first router decreases TTL to 0, drops the packet, and sends an ICMP Time Exceeded message back. Traceroute records this router as hop 1.
2. Send probe packets with TTL = 2.
   The first router forwards the packet, the second router now decrements TTL to 0, drops the packet, and sends ICMP Time Exceeded. Traceroute records this second router as hop 2.
3. Continue increasing TTL: 3, 4, 5, and so on.
   Each time, the next router in the path returns an ICMP Time Exceeded message.
4. Stop when either:
   The destination host responds with a final ICMP or transport layer response, or
   A maximum number of hops is reached.

This technique reveals the chain of routers from the source to the destination, and the time each hop takes to respond.

Different Implementations of Traceroute

Although the core idea is always the same, different operating systems and traceroute tools use different probe types.

A common summary is:

In all cases, routers along the path still generate ICMP Time Exceeded when TTL reaches 0. What differs is how the final destination is detected.

With traditional Unix style traceroute, the destination port is chosen to be a number that is not in use. When the packet reaches the destination host, there is no application listening on that port, so the host responds with an ICMP Port Unreachable message. Traceroute treats this as the signal that the destination is reached and stops probing.

With Windows tracert, probes are ICMP Echo Request messages. The destination replies with ICMP Echo Reply, which also tells the tool that the trace is complete.

Reading Traceroute Output

Traceroute output typically shows one line per hop, with multiple probes per hop. A simple example:

$ traceroute example.com
 1  192.168.1.1    1.1 ms   1.0 ms   0.9 ms
 2  10.0.0.1       5.2 ms   5.0 ms   4.9 ms
 3  203.0.113.1   15.3 ms  15.1 ms  15.0 ms
 4  203.0.113.5   25.4 ms  25.1 ms  25.3 ms
 5  198.51.100.10 50.6 ms  50.2 ms  50.4 ms

Typical elements of each line are:

Hop number. This is the TTL value used for that set of probes.

Router address or name. You may see an IP address, a resolved hostname, or both.

Round trip times (RTTs). Usually three measurements per hop, such as 1.1 ms 1.0 ms 0.9 ms. Each RTT is the time from sending a probe to receiving the ICMP reply from that hop.

The RTT for a hop includes the entire journey to that hop and back, not just the additional delay introduced by this hop alone.

Traceroute often does reverse DNS lookups on each IP address. This means it tries to convert the IP of each hop into a hostname. These names often include clues about locations or providers, but reverse DNS may be missing or misleading.

Time Measurements and What They Mean

Traceroute times are round trip measurements. For a probe to hop $n$:

1. The probe travels from your host through hops $1, 2, ..., n$.
2. The router at hop $n$ sends back an ICMP response.
3. The reply travels back through the network to you.

So an RTT of $20$ ms at hop 3 means that the combined send and return path to hop 3 takes about $20$ ms for that probe.

If you compare RTTs across hops, you may notice that times usually increase as the path progresses, but sometimes they appear to decrease. This can happen because:

Different probe packets follow slightly different paths due to routing changes.

Network queuing and temporary congestion vary over time.

Routers may prioritize transit traffic over ICMP responses.

For these reasons, traceroute gives approximate timing, not exact per hop delay.

Missing Hops and Asterisks

You will often see lines with asterisks in traceroute output, such as:

 4  *  *  *

or

 4  203.0.113.5   30.2 ms   *   30.4 ms

Asterisks usually mean that no reply was received within the tool’s timeout for that specific probe. This can happen if:

The router does not send ICMP Time Exceeded messages.

A firewall filters ICMP or the specific probe type.

The router is too busy or rate limits ICMP responses.

The path is temporarily broken for that specific probe.

If every probe at a hop shows *, it means that hop is not visible to traceroute, but traffic may still be passing through it. If the trace continues with further hops, then packets are still progressing beyond that invisible router.

Private and Public Addresses in Traceroute

In traceroute output, you may see both private and public IP addresses. For example, your first hop might be a private address such as 192.168.1.1, which is likely your home router. Further hops often belong to your ISP and then to other networks.

A typical pattern:

This can help you see where your local network ends and where the wider internet begins.

Path Changes and Asymmetry

Traceroute shows the forward path that the probe packets take. It does not directly show the path of the responses coming back. Paths on the internet are often asymmetric. Packets going to the destination may take a different route than the replies.

Routers might change the path while traceroute is running. That can cause:

Different IPs for the same hop number over multiple runs.

Mixed IPs within one hop if load balancing sends probes over multiple paths.

These behaviors are normal in complex networks.

Load Balancing and Multiple Paths

Many modern networks use load balancing, where traffic is distributed across several parallel links. This can affect traceroute output.

You might see:

Different IP addresses for the same hop across the three probes.

Lines that appear to reorder or fluctuate between runs.

For example:

 5  198.51.100.1   30.0 ms  32.0 ms  31.5 ms
 6  203.0.113.10   40.0 ms  42.1 ms  41.8 ms
 6  203.0.113.11   39.5 ms  40.3 ms  40.1 ms

Some traceroute variants show multiple routers for the same hop if packets are being load balanced. This reveals that there are parallel paths in the network, though the exact behavior depends on the implementation.

Common Uses of Traceroute

Traceroute is especially useful for:

Locating where a problem occurs. If traceroute reaches only a certain hop and all later hops time out, the issue may be after that hop.

Determining whether a problem is inside your own network. If the first or second hop shows issues, it often indicates a local problem or one at your provider’s edge.

Estimating geographic or network distance. Hop counts and hostnames can give an idea of how far away a destination is, although this is not exact.

Visualizing which providers your traffic goes through. Hostnames can reveal ISP and transit provider names.

Limitations and Misinterpretations

It is important not to over interpret traceroute results. Some key limitations are:

Routers may rate limit or deprioritize ICMP. A hop that shows high RTT or packet loss in traceroute may be prioritizing real traffic ahead of traceroute probes. This does not always mean that router is causing problems for normal traffic.

Asymmetric routing. High times at a particular hop may come from delays on the return path, not at that router itself.

Firewalls and filters. Missing hops, asterisks, or abrupt endings can be due to blocking of ICMP or specific probe traffic.

Application level problems. Even if traceroute looks clean, applications may still fail due to issues at higher layers such as ports, protocols, or services.

Traceroute is best used together with other tools, not in isolation.

Practical Tips for Using Traceroute

There are some practical choices you can make to get more useful results:

Run traceroute multiple times. Transient conditions can affect a single run. Multiple runs help you see what is stable and what is variable.

Try different destinations. For example, traceroute to your default gateway, then to a well known internet address. Compare where the pattern changes.

Use both ping and traceroute. Ping gives a simpler, overall reachability check. If ping fails or shows high latency, traceroute can show where along the path this begins.

Consider protocol options. Some traceroute tools let you choose between UDP, ICMP, or TCP probes. If one version appears blocked, another may succeed.

Keep timeouts in mind. If the default timeout is short, slower paths may appear as * even though packets eventually arrive.

In practice, learning to interpret traceroute output comes from looking at many examples and correlating them with real connectivity issues.

Summary

Traceroute is a path discovery tool that uses TTL and ICMP responses to list the routers between a source and a destination. It sends probes with increasing TTL values, records which router responds at each step, and measures round trip time to each hop. While it is extremely useful for understanding paths and localizing problems, its output must be interpreted with awareness of ICMP behavior, load balancing, asymmetric routes, and filtering. When used carefully together with other tools, traceroute is a core part of network troubleshooting.