Table of Contents
Traceroute
Traceroute is a network diagnostic tool that discovers the path packets take from your computer to a destination on the Internet.
Unlike Ping, which only answers:
“Can I reach the destination?”
Traceroute answers:
“How do I reach the destination?”
It identifies each router (called a hop) along the path.
Why Use Traceroute?
Traceroute helps diagnose problems such as:
- Routing failures
- High network latency
- Packet loss
- ISP routing issues
- Network congestion
It is one of the most useful tools for troubleshooting Internet connectivity.
How Traceroute Works
Traceroute sends packets with gradually increasing Time To Live (TTL) values.
Example:
TTL = 1 ↓ Router 1 ↓ ICMP Time Exceeded
Then:
TTL = 2 ↓ Router 1 ↓ Router 2 ↓ ICMP Time Exceeded
Then:
TTL = 3 ↓ Router 1 ↓ Router 2 ↓ Router 3 ↓ ICMP Time Exceeded
This continues until the destination responds.
Each router reveals its address by sending an ICMP Time Exceeded message.
Example Output
A typical traceroute might look like:
1 192.168.1.1 2 10.25.0.1 3 185.229.29.1 4 172.217.20.46
Each line represents one hop.
The final hop is usually the destination.
What Is a Hop?
A hop is one router that forwards your packet.
Example:
Your Computer
│
Hop 1
Home Router
│
Hop 2
ISP Router
│
Hop 3
Regional Router
│
Hop 4
Destination
The number of hops depends on the network path.
Round-Trip Time
Traceroute usually measures the response time for each hop.
Example:
Hop RTT 1 1 ms 2 8 ms 3 21 ms 4 22 ms
A sudden increase may indicate:
- Network congestion
- Long-distance routing
- Slow routers
Why Are Three Times Usually Shown?
Many traceroute implementations send three probes for each hop.
Example:
5 24 ms 25 ms 23 ms
Multiple probes help identify:
- Temporary congestion
- Packet loss
- Variable latency (jitter)
What Does "*" Mean?
Sometimes a hop is displayed as:
7 * * *
This usually means the router did not reply.
Possible reasons include:
- ICMP filtering
- Firewall rules
- Rate limiting
- Timeout
A missing reply does not necessarily mean the router is broken.
If later hops respond normally, the router is still forwarding traffic.
Traceroute vs Ping
| Ping | Traceroute |
|---|---|
| Tests reachability | Discovers the network path |
| Reports overall latency | Reports latency at each hop |
| Uses ICMP Echo | Uses increasing TTL values |
| Does not identify routers | Shows intermediate routers |
These tools complement each other.
Different Implementations
Different operating systems use different probe types.
| Operating System | Typical Probe Type |
|---|---|
| Windows (tracert) | ICMP Echo Request |
| Linux (traceroute) | UDP (default) |
| Linux (optional) | ICMP or TCP |
| macOS | UDP (default) |
Although the probe types differ, the principle remains the same.
Traceroute and Telenegar
Telenegar Trace Route performs traceroute from multiple probe locations.
This allows you to compare routing from different ISPs and regions.
For each probe, Telenegar may report:
- Hop number
- Router IP address
- Hostname (when available)
- Response time
- Packet loss
- Geographic location (when available)
This makes it easier to determine whether a routing problem is:
- Local
- ISP-specific
- Regional
- Global
Example Investigation
Suppose users report that a website is slow.
Ping shows:
Destination reachable RTT = 120 ms
Traceroute shows:
Hop 1 1 ms Hop 2 6 ms Hop 3 9 ms Hop 4 110 ms Hop 5 112 ms
This suggests that the delay begins near Hop 4, helping identify where the problem occurs.
Common Misconceptions
- Traceroute always shows every router.
- False. Some routers do not respond to traceroute probes.
- A timeout means the network is broken.
- False. Many routers intentionally ignore traceroute requests.
- Traceroute always uses ICMP.
- False. Depending on the operating system, it may use ICMP, UDP, or TCP probes.