Mapping the Path With Traceroute

Traceroute (tracert on Windows) reveals the path packets take to a destination, listing each router (hop) along the way and the delay at each. Where ping answers "can I reach it?", traceroute answers "by what path, and where does it slow down or stop?" It is the go-to tool for locating where along a route a problem lives.

Each device that forwards your packet toward the destination is a hop. Traceroute lists hops in order, from your gateway outward across ISPs to the target. By showing the chain of routers, traceroute lets you see the actual journey of your traffic and pinpoint exactly which hop is failing or adding delay.

Traceroute cleverly uses TTL. It sends packets with TTL=1, so the first router discards them and replies with an error. Then TTL=2 to reach the second router, and so on. Each expiring packet reveals one more hop. By stepping TTL upward, traceroute maps the path one router at a time until it reaches the destination.

Each line shows a hop number, the router's IP or name, and usually three timing samples in milliseconds. Times generally rise as hops get more distant. A reasonable, gradual increase is normal. The output lets you watch latency build hop by hop and identify exactly where it jumps unexpectedly.

If traceroute lists several hops and then stops or times out, the problem is likely at or just beyond the last responding hop. This localizes a routing or connectivity failure to a specific point in the path, often distinguishing your network from an ISP's. Knowing the failure is three hops out, in the ISP's core, changes who you call.

Traceroute helps find latency sources. If times are low for several hops and then suddenly spike, that hop or link is adding delay. Remember that a long-distance link, like a transatlantic hop, naturally adds latency. The skill is distinguishing expected distance delay from an abnormal jump that signals congestion or a problem.

An asterisk (*) means a hop did not reply in time. This is common and not always a problem: many routers deprioritize or block the ICMP/UDP replies traceroute relies on, even while happily forwarding real traffic. A few stars mid-path, followed by later hops responding, usually means a quiet router, not a broken one.

Implementations differ. Windows tracert sends ICMP Echo Requests, while traditional Unix traceroute sends UDP packets to high ports; both rely on TTL-expired replies. Because firewalls treat ICMP and UDP differently, the same path can look different from a Windows versus a Linux box. Knowing the method explains some discrepancies.

Traceroute shows only the forward path. The return traffic may take a different route, called an asymmetric path. This means a delay you see could actually be on the way back, which traceroute cannot show directly. Keep this in mind when interpreting results, especially across the public internet where asymmetry is common.

Two enhanced tools combine ping and traceroute. Windows pathping traces the route and then measures per-hop packet loss over time. The popular Unix tool mtr continuously updates a live traceroute with running loss and latency stats. Both are excellent for diagnosing intermittent problems that a single traceroute might miss.

Use traceroute after ping when connectivity to a remote host is poor or failing. It tells you whether the trouble is on your LAN, at your gateway, in your ISP, or far across the internet. Pinpointing the responsible segment lets you fix what you control and escalate what you do not, with evidence in hand.

Test your traceroute knowledge.

You learned traceroute. Key points:

• Traceroute lists each hop and its delay to a destination.
• It works by incrementing TTL so routers reply in turn.
• Where output stops localizes a failure along the path.
• Asterisks often mean a quiet router, not a broken one.
• pathping and mtr add per-hop loss over time.