Explain how ping and traceroute work. What information does each tool provide, and when would you use them?

Question

Accepted Answer

Ping and traceroute are the two most fundamental network troubleshooting tools. They both use ICMP (Internet Control Message Protocol) but provide different types of information, and together they form the starting point of almost any network diagnosis.

Ping tests basic connectivity between your device and a destination by sending ICMP Echo Request packets and waiting for ICMP Echo Reply responses. When you run ping 10.0.0.1, your device sends a series of packets to that address and reports whether each one was successfully returned. The output shows several important metrics: the round-trip time (RTT) in milliseconds, which tells you the latency to that destination; the TTL (Time to Live) value, which indicates how many router hops the reply traveled through; and packet loss percentage, which reveals if any packets were dropped.

You use ping to answer the question "Can I reach this destination?" If pings succeed, basic Layer 3 connectivity exists. If pings fail, either the destination is unreachable, a firewall is blocking ICMP, or there is a routing or connectivity problem along the path. Common ping options include -t for continuous ping on Windows, -c to specify the count on Linux, -s to change the packet size (useful for testing MTU issues), and -f on Linux to set the Don't Fragment bit for path MTU discovery.

Traceroute (tracert on Windows, traceroute on Linux/Mac) maps the path packets take to reach a destination by exploiting the TTL mechanism. It sends packets with incrementally increasing TTL values starting at 1. The first router decrements TTL to 0 and responds with an ICMP Time Exceeded message, revealing its IP address. The next packet has TTL 2, reaching the second router before expiring. This continues until the destination is reached or the maximum hop count is exceeded.

Traceroute shows each hop along the path with its IP address and three RTT measurements. This tells you not just whether you can reach a destination, but exactly which path your traffic takes and where delays occur. A significant jump in latency at a specific hop suggests congestion or a slow link at that point. Asterisks indicate a hop that did not respond, which could mean the device drops ICMP, has rate limiting, or is actually unreachable.

You use traceroute when ping shows high latency or packet loss and you need to identify where in the path the problem is occurring. It is also useful for verifying that traffic follows the expected path through the network, which is important when troubleshooting routing issues.

On Linux, traceroute uses UDP by default (which can be blocked by firewalls), while tracert on Windows uses ICMP. The mtr tool (My Traceroute) combines the functionality of ping and traceroute into a single tool that continuously updates, showing real-time packet loss and latency at each hop. It is an excellent tool for diagnosing intermittent network problems because it runs over time, capturing patterns that a single traceroute would miss.