traceroute [ip]
Traces the route packets take from the source device to a destination IP address, showing each hop along the path, used to diagnose network path issues and latency.
Definition: traceroute [ip] is a Cisco IOS privileged exec command. Traces the route packets take from the source device to a destination IP address, showing each hop along the path, used to diagnose network path issues and latency.
Overview
The `traceroute` command in Cisco IOS is a fundamental diagnostic tool used to trace the path that IP packets take from the source device to a specified destination IP address. It operates by sending packets with progressively increasing Time-to-Live (TTL) values, causing each router along the path to return an ICMP Time Exceeded message, thereby revealing the sequence of hops. This command is essential for network engineers to identify routing loops, high latency links, packet loss points, and asymmetric routing.
Unlike `ping`, which only tests end-to-end reachability, `traceroute` provides hop-by-hop visibility, making it invaluable for isolating network issues in complex topologies. It is typically used during initial network deployment, after configuration changes, or when users report connectivity problems. The command runs in Privileged EXEC mode and does not alter the running configuration; it is a read-only diagnostic tool.
Output is displayed incrementally as responses are received, and the command can be interrupted with Ctrl+Shift+6. Understanding `traceroute` output is critical for CCNA and CCNP candidates, as it directly correlates with routing table knowledge and path selection algorithms. The command supports various options to fine-tune probes, such as specifying source IP, timeout, and number of probes per hop.
In modern IOS versions, `traceroute` uses UDP packets to high ports by default, but it can also use ICMP or TCP depending on configuration. Mastery of this command enables engineers to quickly pinpoint where packets are dropped or delayed, facilitating efficient troubleshooting and network optimization.
traceroute [ip]When to Use This Command
- Verify the path to a remote server when users report connectivity problems.
- Identify where packet loss or high latency occurs in a multi-hop network.
- Troubleshoot routing loops or asymmetric routing by comparing forward and reverse paths.
- Confirm that traffic is traversing expected next-hop routers in a complex topology.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip | A.B.C.D | The destination IP address to trace. Must be a valid IPv4 address in dotted decimal notation. Common mistakes include using a hostname without enabling DNS lookup or specifying an unreachable address, which results in asterisks or timeouts. |
Command Examples
Basic traceroute to a remote host
traceroute 8.8.8.8Type escape sequence to abort. Tracing the route to 8.8.8.8 VRF info: (vrf in name/id, vrf out name/id) 1 192.168.1.1 1 msec 1 msec 1 msec 2 10.0.0.1 5 msec 4 msec 4 msec 3 172.16.1.1 10 msec 10 msec 9 msec 4 8.8.8.8 12 msec 11 msec 12 msec
Each line shows a hop number, the IP address of the router that responded, and the round-trip time (RTT) for three probes in milliseconds. The first hop is the default gateway, subsequent hops are intermediate routers, and the final hop is the destination.
Traceroute with extended options to specify source interface
traceroute 10.10.10.1 source loopback 0Type escape sequence to abort. Tracing the route to 10.10.10.1 VRF info: (vrf in name/id, vrf out name/id) 1 192.168.2.1 2 msec 2 msec 1 msec 2 10.10.10.1 3 msec * 3 msec
The source is set to Loopback0 IP. The asterisk (*) indicates a probe that timed out, which could be due to ICMP rate-limiting or packet loss. The output still shows the path with one hop and the destination.
Understanding the Output
The output begins with a header line indicating the destination. Each subsequent line represents a hop (router) along the path. The hop number is followed by the IP address of the responding router.
Three probe times are shown in milliseconds; if a probe times out, an asterisk (*) appears. Consistent high latency or timeouts at a specific hop indicate a problem. The final hop should be the destination IP; if it is not reached, the last responding hop is where the failure occurs.
Configuration Scenarios
Tracing route to a remote server across the internet
A user reports slow access to a public web server at 8.8.8.8. The network engineer needs to identify which hop introduces latency or packet loss.
Topology
R1(Gi0/0)---192.168.1.0/24---(Gi0/0)ISP_Router---Internet---(Gi0/0)8.8.8.8Steps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Run traceroute to the destination: traceroute 8.8.8.8
- 3.Step 3: Observe the output, noting each hop IP and round-trip time (RTT).
- 4.Step 4: If asterisks appear, consider increasing timeout or using extended traceroute options.
! No configuration required; command is run in EXEC mode Router> enable Router# traceroute 8.8.8.8
Verify: Expected output shows a list of hops with IP addresses and RTTs. For example: '1 192.168.1.1 1 ms 1 ms 1 ms' indicates the first hop responds quickly.
Watch out: If the destination does not respond to UDP probes (common for firewalls), the trace may show asterisks. Use extended traceroute with ICMP or TCP probes instead.
Tracing route within an enterprise network to diagnose a routing loop
Users in VLAN 10 cannot reach the server at 10.10.10.10. The engineer suspects a routing loop between two core switches.
Topology
SW1(Vlan10)---10.10.20.0/24---(Gi0/1)SW2---10.10.30.0/24---(Gi0/2)SW3---10.10.10.0/24---ServerSteps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Run traceroute from SW1: traceroute 10.10.10.10
- 3.Step 3: Look for repeating hop IPs indicating a loop.
- 4.Step 4: If loop detected, check routing protocols and static routes on involved devices.
! No configuration; diagnostic command SW1> enable SW1# traceroute 10.10.10.10
Verify: A loop appears as the same hop IP repeating with increasing TTL. For example: '2 10.10.20.2 1 ms 1 ms 1 ms' then '3 10.10.20.2 1 ms 1 ms 1 ms' indicates a loop.
Watch out: Some routers may not send ICMP Time Exceeded messages due to ACLs, causing asterisks. Verify that ACLs permit ICMP type 11.
Troubleshooting with This Command
When using `traceroute` for troubleshooting, a healthy output shows each hop responding with a valid IP address and consistent round-trip times (RTTs). The first hop is typically the default gateway, and subsequent hops should progress toward the destination without repeating IPs. Problem indicators include asterisks (* * *) at a hop, which suggest no response due to packet loss, firewall filtering, or routing issues.
High RTT values (e.g., >100 ms) indicate latency, possibly due to congestion or long-distance links. A sudden jump in RTT often points to a saturated link or suboptimal path. If the trace stops at a certain hop and subsequent hops show asterisks, the issue is likely at that hop or beyond.
Focus on the first hop that fails to respond; check its routing table, ACLs, and interface status. A routing loop manifests as the same hop IP appearing multiple times with increasing TTL; this indicates packets are being forwarded in a circle. To diagnose, correlate `traceroute` output with `show ip route` on the suspect routers to verify next-hop consistency.
Also use `ping` with varying TTL values to isolate the loop. For asymmetric routing, the return path may differ; use extended `traceroute` with a specific source IP to trace the return path. Step-by-step diagnostic flow: 1) Run basic `traceroute` to identify the problematic hop. 2) If asterisks appear, run extended `traceroute` with ICMP or TCP probes to bypass UDP filtering. 3) On the failing hop, check interface status (`show interfaces`), ACLs (`show access-lists`), and routing table (`show ip route`). 4) Use `debug ip icmp` cautiously to see ICMP messages. 5) Correlate with `show ip cef` to verify CEF switching. 6) If latency is high, use `show interfaces` for errors or `show process cpu` for high CPU. 7) For loops, check routing protocol metrics and redistribute filters. `traceroute` output combined with `ping` and `show ip route` provides a powerful triad for network fault isolation.
CCNA Exam Tips
Remember that traceroute uses UDP packets with increasing TTL values by default on Cisco IOS; ICMP echo requests are used on Windows.
An asterisk (*) in output may indicate a router that does not respond to traceroute probes (e.g., due to ACLs or rate-limiting), not necessarily a failure.
The command 'traceroute' is used in Privileged EXEC mode; in user EXEC mode, use 'traceroute' also works but may have limited options.
Know that the 'source' option allows you to specify a different source IP, useful for testing from specific interfaces.
Common Mistakes
Mistake: Forgetting that traceroute uses UDP and may be blocked by firewalls; use extended options to change to ICMP if needed.
Mistake: Interpreting a single asterisk as a failure; multiple consecutive asterisks indicate a true problem.
Mistake: Not using the 'source' option when troubleshooting from a specific subnet, leading to misleading paths.
traceroute [ip] vs ping [ip]
Both traceroute and ping are network diagnostic tools used to test connectivity, but they serve different purposes. Traceroute reveals the hop-by-hop path and per-hop latency, while ping only checks end-to-end reachability and round-trip time. They are often considered together because both use ICMP (by default) and are the first commands used when troubleshooting network issues.
| Aspect | traceroute [ip] | ping [ip] |
|---|---|---|
| Output information | Lists each intermediate router (hop) with IP address and round-trip time per hop | Reports a single summary of packets sent, received, and round-trip time for the destination |
| Protocol used | Default uses ICMP echo probes with incrementing TTL (UDP on some IOS versions) | Uses ICMP echo request and echo reply messages |
| Time measurement | Measures latency per hop (three probes per hop) | Measures overall round-trip time to destination |
| Hop-by-hop info | Provides IP and timing for each router along path | Does not show intermediate hops |
| Firewall traversal | Can be blocked by firewalls that filter ICMP time-exceeded or UDP high ports | Can be blocked by firewalls filtering ICMP echo requests/replies |
| Typical use case | Identify where packets are dropped or delayed (path MTU, routing loops) | Quick check if a host is reachable and responsive |
Use traceroute [ip] when you need to diagnose which hop along the path is causing high latency or packet loss.
Use ping [ip] when you need a quick, simple test of end-to-end connectivity and basic round-trip time.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `traceroute` command syntax and output are identical to classic IOS. However, IOS-XE supports VRF-aware tracing: `traceroute vrf <vrf-name> <ip>`. NX-OS uses `traceroute <ip>` but also supports extended options via `traceroute <ip> [source <ip>] [ttl <min> <max>] [wait <seconds>] [probe <count>]`.
The output format is similar but may display hop IPs differently. On ASA firewalls, the equivalent command is `traceroute <ip>` in privileged mode, but the ASA does not generate ICMP Time Exceeded by default; it uses UDP probes. For IOS-XR, the command is `traceroute <ip>` with options like `source`, `ttl`, `timeout`, and `probe`.
Output is line-based with hop number, IP, and RTT. In older IOS 12.x, the default probe count is 3; in 15.x and later, it remains 3 but extended options are more consistent. There are no significant differences in output between versions, but newer IOS supports IPv6 `traceroute ipv6`.
Always verify that the device has a route to the destination; otherwise, the first hop may show the default gateway and then asterisks.
Related Commands
ping [ip]
The ping command sends ICMP echo requests to a destination IP address to test network connectivity and measure round-trip time.
show ip interface brief
Displays a one-line summary of all interfaces showing the IP address assigned, operational status (up/down), and line protocol status. The fastest way to get a device health overview.
show ip route
Displays the IP routing table showing all known routes, their source protocols, administrative distances, metrics, next-hops, and outgoing interfaces.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions