Traceroute

Traceroute (tracert on Windows) works by sending packets with incrementally increasing TTL (Time to Live) values, exploiting the ICMP Time Exceeded message mechanism. Packet 1 has TTL=1 — the first router decrements it to 0, sends ICMP Time Exceeded back. Packet 2 has TTL=2 — passes the first router, stopped at the second. This continues until the destination is reached. On Unix/macOS, traceroute uses UDP probes by default (ports 33434+); on Windows, tracert uses ICMP Echo. TCP traceroute (traceroute -T) uses TCP SYN packets on a specified port, useful for tracing through firewalls that block ICMP/UDP.

Each hop shows 3 probe round-trip times in milliseconds. Asterisks (* * *) appear when a router silently drops probes — common for routers configured with ICMP rate-limiting or ACLs. Asymmetric routing (different forward/return paths) can make interpretation complex: the latency shown at each hop reflects the RETURN path from that router to your machine, not just that segment's latency. High latency at a single intermediate hop but normal latency at subsequent hops is typically an ICMP rate-limiting artifact at that router, not an actual bottleneck.

Traceroute is invaluable for network diagnostics: identifying where packet loss occurs, detecting BGP routing changes, discovering CDN and ISP topology, measuring latency per network segment, and debugging asymmetric routing. Tools like mtr (My TraceRoute) combine ping and traceroute in a continuous real-time display, making it easier to identify intermittent packet loss. Modern enterprise networks use MPLS (Multi-Protocol Label Switching) which can cause traceroute to show only edge routers, hiding internal MPLS hops. Paris-traceroute and Dublin-traceroute use flow-aware probing to produce consistent results in load-balanced networks.

Network engineers use traceroute output to calculate per-segment latency by subtracting the previous hop RTT from the current hop RTT. This reveals latency-heavy segments in the path. Multiple traceroutes from different geographic vantage points help identify whether routing issues are localized or widespread. Services like Thousand Eyes, Catchpoint, and the Looking Glass networks operated by major ISPs provide multi-point traceroute capabilities. When comparing routes, note that internet routing is asymmetric by design — the path taken for outbound packets and the path taken by return packets may traverse completely different networks, which complicates latency attribution.