traceroute &
tracert Explained
traceroute (Linux / macOS) and tracert (Windows) map the path packets take across a network — hop by hop — revealing where delays and failures occur between you and any destination.
Every IP packet carries a TTL (Time To Live) value — a counter that each router decrements by one. When TTL hits zero the router drops the packet and sends back an ICMP "Time Exceeded" message. traceroute exploits this deliberately.
By sending probes with TTL = 1, 2, 3 … and collecting the ICMP replies, traceroute builds a map of every router on the path.
Each row in the output represents one hop. Three probes are sent per hop and the round-trip time (RTT) for each is reported. A * means no reply was received within the timeout.
| Column | Meaning |
|---|---|
| Hop # | Sequence number — 1 is the first router (usually your gateway) |
| Hostname / IP | Identity of the router at that hop |
| RTT 1, 2, 3 | Round-trip times for the three probes sent to that hop (ms) |
| * * * | No reply received — router may block ICMP, or packet was lost |
What to look for: a sudden large jump in RTT between two consecutive hops points to latency at that link. Consistent * * * from a hop onwards suggests a firewall or routing black hole.
| Flag | Description | Example |
|---|---|---|
| -n | Skip DNS — show IPs only (faster) | traceroute -n 8.8.8.8 |
| -m <hops> | Max hops (default 30) | traceroute -m 20 8.8.8.8 |
| -q <n> | Probes per hop (default 3) | traceroute -q 5 8.8.8.8 |
| -w <sec> | Timeout per probe (default 5s) | traceroute -w 2 8.8.8.8 |
| -I | Use ICMP instead of UDP | traceroute -I 8.8.8.8 |
| -T | Use TCP SYN probes (port 80) | traceroute -T 8.8.8.8 |
| -s <src> | Bind to a specific source IP | traceroute -s 10.0.0.2 8.8.8.8 |
| Flag | Description | Example |
|---|---|---|
| -d | Skip DNS — show IPs only | tracert -d 8.8.8.8 |
| -h <hops> | Max hops (default 30) | tracert -h 20 8.8.8.8 |
| -w <ms> | Timeout per reply in ms | tracert -w 2000 8.8.8.8 |
| -4 / -6 | Force IPv4 or IPv6 | tracert -6 google.com |
| Symptom | Likely meaning |
|---|---|
| High RTT at one hop, normal after | That router deprioritises ICMP — not a real bottleneck |
| RTT grows steadily each hop | Normal — distance and propagation delay accumulating |
| Sudden RTT spike that persists | Congested or degraded link at that hop |
| * * * then destination replies | Intermediate router blocks ICMP — path is fine |
| * * * all the way to end | Routing black hole, firewall blocking all probes, or host down |
| Trace loops back to same hop | Routing loop — contact the upstream provider |
-I (ICMP) or -T (TCP) if you get all stars.mtr google.com