How does traceroute work, and when would you use it during troubleshooting? What does each hop in the output represent?

Question

Accepted Answer

Traceroute is a diagnostic tool that maps the network path between your device and a destination by revealing every router, or hop, along the way. While ping tells you whether a destination is reachable, traceroute tells you the route your traffic takes to get there and where along that path problems might exist.

Traceroute works by exploiting the Time to Live field in IP packets. Each packet sent across a network has a TTL value that decreases by one at every router it passes through. When the TTL reaches zero, the router discards the packet and sends back an ICMP Time Exceeded message to the sender.

Traceroute sends a series of packets with incrementally increasing TTL values. The first packet has a TTL of 1, so the first router along the path decreases it to zero and responds. The second packet has a TTL of 2, reaching the second router before expiring. This continues until a packet reaches the final destination, which responds with an ICMP Echo Reply or Port Unreachable message.

Each hop in the traceroute output represents a router or Layer 3 device along the path. For each hop, the output typically shows the hop number, the IP address or hostname of the router, and three round-trip time measurements. These times indicate how long it took for a packet to reach that specific hop and return.

When interpreting traceroute output, look for significant jumps in latency between consecutive hops. A sudden increase from 5 milliseconds to 150 milliseconds between hop 4 and hop 5 suggests the link between those two routers is congested or spans a long distance, such as a transatlantic link. Consistent high latency from a certain hop onward indicates the problem is at or before that hop.

Asterisks in the output mean a hop did not respond within the timeout period. A few asterisks in the middle of an otherwise successful traceroute usually indicate a router configured not to respond to traceroute probes, which is common and not necessarily a problem. However, if every hop after a certain point shows asterisks, the problem likely exists at or near the last responding hop.

NOC analysts commonly use traceroute when a remote site or service is unreachable or experiencing high latency. The command is tracert on Windows and traceroute on Linux and macOS. Comparing the current traceroute with a known-good baseline path can quickly reveal routing changes or failed links that are causing the issue.