# Traceroute

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/traceroute

## Quick definition

Traceroute is a command you use to trace the path that internet traffic takes to reach a website or server. It shows every router your data passes through and how long each step takes. This helps you find where a connection is slow or broken.

## Simple meaning

Think of sending a package across the country. You hand it to your local post office, which forwards it to a regional hub, then to another hub, and finally to the destination post office, which delivers it. Traceroute works the same way for internet data. When you visit a website, your computer doesn't send data directly to that site's server. Instead, the data travels through a series of routers, which are specialized computers that direct traffic across networks. Each router is like a post office, it receives the data, reads the address, and sends it to the next router that is closer to the final destination.

Traceroute sends out test packets with special settings that make each router along the path send back a reply when it receives the packet. The first test packet is set to expire after one hop, so the first router replies and tells you its identity. The next test packet is set to expire after two hops, so the second router replies, and so on. By doing this step by step, Traceroute builds a map of every router between you and the target. It also measures how long each hop takes, so you can see which segment of the journey is slow or failing. 

For example, if you live in New York and try to reach a server in London, Traceroute might show you that your data goes through routers in New York, then across the Atlantic Ocean, then through London. If one of those hops takes a very long time or fails entirely, you know exactly where the problem is. In everyday life, this is like a delivery service tracking your package at every checkpoint. Traceroute gives network administrators that same visibility for internet traffic, allowing them to diagnose performance issues, find points of congestion, and identify where a connection is blocked.

## Technical definition

Traceroute is a network diagnostic utility that uses Internet Control Message Protocol (ICMP) echo request packets (on Unix/Linux) or UDP packets (on Windows) to discover the path between a source host and a destination host across an IP network. The tool exploits the Time-To-Live (TTL) field in the IP header, which is decremented by each router that forwards the packet. When the TTL reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source, revealing the router's IP address and the round-trip time (RTT) of that hop.

On Linux and macOS, Traceroute sends a series of UDP packets to a high port on the destination, starting with a TTL value of 1. The first router that receives the packet decrements the TTL to 0, drops the packet, and returns an ICMP Time Exceeded message (type 11, code 0). The source records the source IP of that ICMP message as the first hop. The second packet is sent with TTL=2, making it reach the second router before expiring, and that router replies with its own Time Exceeded message. This process continues until a packet reaches the destination, which does not send a Time Exceeded message. Instead, the destination returns an ICMP Port Unreachable message (type 3, code 3) because the UDP packet is addressed to a port that is not in use. The traceroute utility recognizes this final response and stops probing.

On Windows, the tracert command uses ICMP echo request packets (ping packets) instead of UDP. The behavior is otherwise identical, each probe has an incrementing TTL, and intermediate routers return ICMP Time Exceeded messages. The final destination sends an ICMP Echo Reply (type 0) to indicate it has been reached. Modern implementations, such as MTR (My Traceroute), combine Traceroute and ping to provide continuous, real-time statistics of each hop, including packet loss percentages and jitter. Traceroute results can be influenced by routing policies, firewalls, and load balancers. Some routers may not respond to Traceroute probes if they are configured to not send ICMP Time Exceeded messages, leading to asterisks (*) in the output, which indicate a hop that did not respond within the timeout period.

## Real-life example

Imagine you are mailing a letter to a friend who lives in another country. You drop the letter at your local post office. That post office does not send the letter directly to your friend's house. Instead, it forwards the letter to a regional sorting center. The regional center forwards it to an international hub, which sends it to a distribution center in your friend's country. That center forwards it to a local post office near your friend, and finally a mail carrier delivers it. Traceroute is like a tracking service that checks the letter's progress at each of these points.

You could simulate this by mailing a series of letters with instructions. The first letter says "Send back a postcard after the first post office." The second says "Send back a postcard after the second post office." The third says "Send back a postcard after the third post office," and so on. When you receive the postcards back, you know the route your letters took and how long each leg of the journey took. If one post office is very slow, you would see a long delay on the postcard from that point. If a post office never sends a postcard back, you know something is wrong at that step.

This is exactly how Traceroute works with network data. Your computer sends out a series of test packets, each with a different "lifespan" (TTL). The first packet is designed to expire at the first router, which then sends a reply back. The second packet expires at the second router, and so on. By collecting all these replies, Traceroute builds a complete map of the route your data takes across the internet, complete with timing information for each hop. If a router does not reply, you see an asterisk, indicating a potential problem or a device that is configured to remain silent.

## Why it matters

In practical IT, Traceroute is an essential tool for network troubleshooting and performance monitoring. When users complain that a website is slow or unreachable, network administrators use Traceroute to identify the source of the problem. For example, if a user in a branch office cannot access a cloud application, a Traceroute can show whether the issue is within the local network (the first few hops), at the internet service provider (ISP), or at the cloud provider's network (the last few hops). This saves hours of guesswork and allows teams to escalate issues to the correct provider. Traceroute is also used to diagnose asymmetric routing, where the forward path to a destination is different from the return path. This can cause performance issues or firewall problems because traffic may arrive from an unexpected source.

Traceroute is also valuable for capacity planning and network design. By running Traceroutes to critical destinations over time, engineers can see how latency changes during peak hours, identify congested links, and make informed decisions about upgrading bandwidth or changing routing policies. In security operations, Traceroute helps trace the origin of malicious traffic or determine the true source of a distributed denial-of-service (DDoS) attack by mapping the path back to the source. Traceroute is a standard tool for verifying that VPN tunnels, MPLS circuits, or direct connections are functioning correctly. If a Traceroute shows unexpected hops, it may indicate a misconfiguration, a routing loop, or a security breach. For anyone studying for IT certifications like CompTIA Network+, CCNA, or the Network+ certification, understanding Traceroute is not just theory, it is a practical skill tested in labs and exam scenarios. You must know the command syntax, how to interpret the output, and what common issues look like in a traceroute report.

## Why it matters in exams

Traceroute is a frequently tested concept in several IT certification exams, particularly those focused on networking fundamentals. In CompTIA Network+ (N10-008 and N10-009), Traceroute appears under Objective 5.2, which covers network troubleshooting methodology and tools. Candidates are expected to know the command syntax (tracert on Windows, traceroute on Linux/macOS), how to read the output, and how to use the results to identify issues like high latency, packet loss, or a complete failure at a specific hop. Questions may present a scenario where a user reports slow internet access, and you must choose the correct tool to isolate the problem, Traceroute is often the answer. You may also see questions that show a traceroute output with asterisks, and you must explain what those asterisks mean (no response from that router within the timeout period).

For Cisco CCNA (200-301), Traceroute is a core command used in both the Switching, Routing, and Wireless Essentials and the Enterprise Networking, Security, and Automation exam objectives. CCNA questions frequently involve interpreting a traceroute to determine which router is failing or to verify that a path has been updated after a routing protocol change. Candidates must understand that Traceroute uses UDP (on Linux/Cisco devices) or ICMP (on Windows) and that firewalls may block these packets. A common exam scenario is that a Traceroute works from a source but not from a destination, indicating a one-way firewall rule. In Network+ and CCNA, you may also be asked to compare Traceroute with Ping, Traceroute provides hop-by-hop details, while Ping only tells you if the destination is reachable and the overall round-trip time. Traceroute is also tested in the context of IPv6, where the command is often traceroute6 or tracert -6. For the CompTIA A+ core exams, Traceroute is a lighter topic but still appears under networking tools. Understanding Traceroute will help you answer multiple-choice, fill-in-the-blank, and simulation questions where you must choose the correct command or interpret output to diagnose a network path issue.

## How it appears in exam questions

Traceroute exam questions typically fall into three patterns: command recall, output interpretation, and scenario-based troubleshooting. Command recall questions are straightforward and ask which command to use on a given operating system. For example: 'A technician needs to trace the path from a Windows workstation to a web server. Which command should they use?' The correct answer is 'tracert'. Similarly, for Linux, the answer is 'traceroute'. Some questions may ask for the protocol used, 'Traceroute on Linux uses which initial protocol by default?' The answer is UDP.

Output interpretation questions present a traceroute result and ask the test taker to diagnose the problem. For instance: 'Given the following traceroute output, what is the most likely issue at hop 4?' The output might show sequential times for hops 1-3, but hop 4 shows asterisks and then hop 5 shows a high latency. The correct interpretation could be that the router at hop 4 is configured to not respond to Traceroute probes (a common firewall policy), or that there is a routing loop causing packets to be dropped. Another common pattern shows high latency only after a certain hop, indicating that the link between hop 3 and hop 4 is congested or has high propagation delay. Questions may also show that a Traceroute completes successfully but the website is still unreachable, in which case the issue is likely at Layer 7 (application layer) or a firewall blocking the specific application port.

Scenario-based troubleshooting questions are the most complex. For example: 'A remote worker reports that they cannot connect to the corporate VPN from home. You run a traceroute to the VPN server. The first three hops complete quickly, but hop 4 times out and no further hops are shown. What does this indicate?' The correct answer is that the packet is being dropped at the router at hop 4, possibly because that router does not have a route back to the source, or there is a firewall blocking the traceroute traffic. Another scenario: 'You have two routers configured with OSPF. After making a change to the OSPF cost, you run a traceroute and see that traffic is still taking the old path. What does this tell you?' The answer is that the OSPF route has not converged yet, or the change was not applied correctly. In the Network+ exam, you may also see a question asking which metric Traceroute measures, with the correct answer being round-trip time (RTT) for each hop.

## Example scenario

You are a network technician at a mid-sized company. The CEO calls from his office and says he cannot access the company's cloud-based CRM application at crm.example.com. You remotely take over his workstation and open a command prompt. You type 'tracert crm.example.com' and press Enter. The output appears quickly. The first hop is the company's internal router at 192.168.1.1, and it responds in 2 milliseconds. The second hop is the ISP's router at 10.0.0.1, responding in 5 milliseconds. The third hop shows an IP address of 203.0.113.1 with a time of 15 milliseconds. The fourth hop shows 198.51.100.1 but the time jumps to 250 milliseconds. The fifth hop shows request timed out. The sixth hop also times out. The seventh hop shows a destination address of 192.0.2.10 with a time of 400 milliseconds, and then the trace completes.

You analyze the output. A normal round-trip time to a cloud server should be under 100 milliseconds. The jump from 15 ms to 250 ms at hop 4 indicates a severely congested or slow link. The two consecutive timeouts at hops 5 and 6 could mean that those routers are configured to not respond to Traceroute probes, which is common for core internet routers. However, the destination still responds, even though the final hop took 400 ms. You suspect that the connection is suffering from high latency at hop 4. You check the IP address of hop 4 and see that it belongs to the CEO's ISP. You call your ISP provider and report the issue, providing them with the Traceroute results. They confirm a faulty line card on their router at that hop and reroute the traffic, restoring the CEO's access within minutes. The Traceroute allowed you to isolate the problem to the ISP's network instead of wasting hours troubleshooting the company's internal infrastructure or the cloud provider's servers.

## Common mistakes

- **Mistake:** Thinking Traceroute always shows accurate hop-by-hop latency for every router.
  - Why it is wrong: Many routers, especially core internet routers, are configured to prioritize forwarding data over generating ICMP responses. They may not send Time Exceeded messages, leading to asterisks in the output. This does not mean the router is down or that the path is broken.
  - Fix: Understand that asterisks simply mean the router did not respond to the probe. If the destination is reached and subsequent hops respond, the network is probably fine. Focus on the overall path and whether the final destination responds.
- **Mistake:** Confusing Traceroute with Ping and using them interchangeably.
  - Why it is wrong: Ping only checks end-to-end reachability and measures total round-trip time. Traceroute gives hop-by-hop detail. Using Ping when you need to locate a specific slow link will not provide the necessary information.
  - Fix: Use Ping first to test if a host is reachable. If it is reachable but slow, use Traceroute to identify which hop is causing the delay. Never substitute one for the other.
- **Mistake:** Assuming that the path shown by Traceroute is the same in both directions.
  - Why it is wrong: Internet routing is often asymmetric. The path a packet takes from source to destination may be different from the return path. Traceroute only shows the forward path from the source to the destination. The return path might have different latency or packet loss.
  - Fix: If you suspect asymmetric routing, run a Traceroute from both ends if possible. Alternatively, use tools like MTR that also show reverse path information. Do not assume symmetric routing in your diagnosis.
- **Mistake:** Misinterpreting high latency at a middle hop as a problem at that specific router.
  - Why it is wrong: High latency at hop 4 could be caused by the processing time of the router generating the ICMP reply, not necessarily by congestion on the link. The actual forwarding of data might be faster. The latency measurements in Traceroute include the time for the router to generate the error message, which can be delayed if the router is busy.
  - Fix: Look for consistent high latency across multiple consecutive hops or a sudden large increase that persists. Run the Traceroute multiple times to see if the high latency is consistent. Use MTR to see packet loss percentages alongside latency.
- **Mistake:** Forgetting that firewall rules can block Traceroute traffic.
  - Why it is wrong: Some networks block ICMP Time Exceeded messages or UDP probes for security reasons. This can make a Traceroute appear to fail when the network is actually working. For example, a Windows firewall may block incoming ICMP, causing a Linux Traceroute from a remote host to show all hops timing out.
  - Fix: If you get asterisks for all hops after a certain point but the destination is reachable via Ping, check firewall rules. You can try a different Traceroute method, such as using TCP probes (hping3 or tcptraceroute) which may be allowed through the firewall.

## Exam trap

{"trap":"A Traceroute shows that hop 4 has high latency (e.g., 300 ms), but all subsequent hops also show similarly high latency. The exam trap is to conclude that the issue is at hop 4 and that hop 4's router is faulty.","why_learners_choose_it":"Learners see that the latency dramatically increases at hop 4 and stays high. They assume that hop 4 is the cause because it is the first point where the latency changes. This is a natural but incorrect deduction, the actual delay is likely on the link between hop 3 and hop 4, not on hop 4 itself.","how_to_avoid_it":"Understand that the latency printed for a hop is the time it took for the probe to reach that router and for the ICMP reply to return. If the latency is high for hop 4 and remains high for all subsequent hops, the delay occurred somewhere before hop 4, likely on the link between hop 3 and hop 4. The router at hop 4 just reports the cumulative delay. To isolate the exact link causing the delay, subtract the latency of hop 3 from hop 4. The difference is the time spent traversing that specific link."}

## Commonly confused with

- **Traceroute vs Ping:** Ping tests reachability and measures total round-trip time between source and destination, without showing the path. Traceroute shows the exact path and per-hop latency. Ping is for checking if a host is alive; Traceroute is for finding where delays or failures occur along the path. (Example: If a website is slow, Ping tells you the total delay is 500 ms. Traceroute tells you the first three hops take 2 ms each, but the fourth hop takes 490 ms, allowing you to locate the problem link.)
- **Traceroute vs PathPing:** PathPing (Windows) combines Traceroute and Ping, it first traces the path and then sends many pings to each hop to calculate packet loss and latency statistics over time. Traceroute gives a single snapshot of the path. PathPing provides more detailed performance data for each hop. (Example: Traceroute shows hop 4 with a latency of 100 ms in one test. PathPing sends 100 pings to hop 4 and tells you that the average latency is 150 ms, with 5% packet loss.)
- **Traceroute vs MTR (My Traceroute):** MTR is an advanced tool that continuously runs Traceroute and reports live statistics like loss percentage, average latency, and jitter for each hop. Standard Traceroute runs a fixed number of probes per hop (usually three) and stops. MTR provides a real-time view that updates every second. (Example: You run Traceroute once and see no loss. You run MTR for 5 minutes and discover that hop 4 has 3% packet loss, which is intermittent and may cause periodic slowdowns.)
- **Traceroute vs Nmap:** Nmap is a network scanning tool used for security auditing, discovering hosts, and identifying open ports. Traceroute is strictly a path discovery tool. Nmap can perform a traceroute as part of its scan, but its primary purpose is completely different, network mapping and vulnerability assessment. (Example: You use Nmap to scan all devices on a subnet and see which ports are open. You use Traceroute to see the path your data takes to reach a specific device across the internet.)

## Step-by-step breakdown

1. **Initiating the Traceroute** — The user types 'traceroute example.com' (Linux) or 'tracert example.com' (Windows). The tool resolves the destination hostname to an IP address via DNS. It then begins sending the first probe packet with a Time-To-Live (TTL) value of 1. This packet is typically a UDP packet on Linux or an ICMP echo request on Windows, addressed to the destination IP.
2. **First Hop Router Receives the Probe** — The first router in the path receives the packet. It decrements the TTL from 1 to 0. According to IP protocol rules, the router discards the packet and sends an ICMP Time Exceeded message (type 11, code 0) back to the source. The source records the source IP address of this ICMP message, which reveals the identity of the first-hop router. It also measures the time elapsed between sending the probe and receiving the reply.
3. **Sending Probes with Incrementing TTL** — Traceroute sends the next probe with TTL=2. The first router decrements it to 1 and forwards it. The second router decrements it to 0 and sends its own Time Exceeded message. This process repeats, each probe has a TTL incremented by 1, until the packet reaches the destination. Three probes are typically sent per TTL value to get a more reliable latency measurement.
4. **The Destination Responds** — When the probe finally reaches the destination host with a remaining TTL of 1, the destination does not send a Time Exceeded message. On Linux, the destination sees the UDP packet on a high port and sends an ICMP Port Unreachable message (type 3, code 3). On Windows, the destination receives the ICMP Echo Request and sends an ICMP Echo Reply. This response tells Traceroute that the destination has been reached.
5. **Output Generation and Interpretation** — Traceroute stops sending probes after detecting the destination response. It displays output showing hop numbers, the IP addresses (and hostnames if reverse DNS lookup succeeds) of each responding router, and the round-trip times for the three probes. Hops that do not respond within the timeout are shown as asterisks. The final line shows the destination IP and overall time. The output helps diagnose where packet loss or high latency occurs along the path.

## Practical mini-lesson

Traceroute is a vital tool that every network professional must master, not only for passing exams but for real-world troubleshooting. In practice, you will use Traceroute to isolate connectivity problems that users report. For example, a user in a branch office cannot access a file server in headquarters. Your first step is to open a command prompt on the user's workstation and run 'tracert file-server-ip'. You examine the output. If the first hop (the branch's default gateway) responds but the second hop (the WAN router) does not, the issue is likely between the branch and the WAN, possibly a failed link, a misconfigured VLAN, or a firewall blocking traffic. If all hops respond but the final destination does not, the problem is on the file server itself or on its local network.

To use Traceroute effectively, you need to understand how to read the output. The times are in milliseconds. A sudden jump in latency that persists across all subsequent hops indicates a slow link between the previous hop and the hop where the jump occurs. For example, if hop 3 shows 10 ms and hop 4 shows 300 ms, the slow link is between hop 3 and hop 4. If hop 4 shows 300 ms, hop 5 shows 301 ms, and hop 6 shows 305 ms, the problem is between hops 3 and 4, not on any single router. Packet loss is indicated by asterisks for one or more probes at a particular hop. Occasional asterisks are normal due to routers prioritizing forwarding over ICMP replies. Continuous packet loss at one hop, followed by success at later hops, suggests that router is overloaded or has a connectivity issue to the next hop.

In a configuration context, you can use Traceroute to verify routing changes. After adjusting OSPF costs or static routes, run a traceroute to a key destination to confirm the traffic takes the desired path. If it does not, check your routing tables and redistribute policies. Traceroute can also help detect routing loops, if you see the same IP address appearing multiple times, a loop is present. In security, you can use Traceroute to trace the source of a denial-of-service attack by running it from different vantage points. Finally, you should know that Traceroute traffic itself can be blocked. If you get asterisks for every hop but the destination responds to Ping, the firewall is likely blocking the ICMP Time Exceeded messages. You can try using a different protocol variant, such as TCP Traceroute (tcptraceroute) or enabling the '-I' flag on Linux to force ICMP probes. Memorizing these practical nuances will set you apart in both exams and your career.

## Memory tip

Traceroute is like a road trip with an expiration date on each car, each car can only go one hop before asking for directions.

## FAQ

**What does an asterisk (*) mean in a traceroute output?**

An asterisk means that router did not send an ICMP Time Exceeded message back within the timeout period. This is often because the router is configured to not respond to traceroute probes, or the response was lost. It does not necessarily mean the router is down.

**Why does traceroute on Windows use ICMP while Linux uses UDP?**

It's a historical design choice. The Windows tracert command uses ICMP Echo Requests (like ping) as the probe packets. The Linux traceroute command uses UDP packets to high ports. Both achieve the same goal, but some firewalls may block one type more than the other, affecting results.

**Can traceroute be used to bypass firewalls?**

No, Traceroute is a diagnostic tool, not a bypass tool. Firewalls can block the ICMP or UDP packets Traceroute uses, and they can also inspect and block the response packets. If a firewall is blocking Traceroute, you will see asterisks or incomplete paths.

**How many probes does traceroute send per hop?**

By default, Traceroute sends three probes per hop. This allows for some statistical measurement of latency and helps detect fluctuations. If all three probes time out, you see three asterisks.

**Is traceroute useful for IPv6?**

Yes, Traceroute works for IPv6 as well. On Windows, you use 'tracert -6' and on Linux you can use 'traceroute6' or 'traceroute -6'. The IPv6 version works the same way, using the Hop Limit header instead of TTL.

**Why does my traceroute show private IP addresses (like 192.168.x.x) in the middle of the path?**

This means the traffic is going through a network that uses private IP addresses, such as a carrier-grade NAT or a corporate internal network between sites. It is normal if you are on a private network or behind an ISP that uses CGNAT.

**Can I use traceroute on a mobile device?**

Yes, there are apps that implement Traceroute for smartphones. However, built-in mobile operating systems may not include a Traceroute command, so you usually need to install a third-party app that sends similar probe packets.

## Summary

Traceroute is an indispensable network diagnostic tool that shows the path data takes from your computer to a destination, revealing every intermediate router and the time taken to reach each one. It works by sending packets with increasing TTL values, causing each router along the path to reply with an ICMP Time Exceeded message. This hop-by-hop detail is crucial for pinpointing where network congestion, high latency, or failures occur. Unlike Ping, which only tests end-to-end reachability, Traceroute gives you a map of the route, allowing you to identify problematic links or routers quickly.

For IT certification exams such as CompTIA Network+, Cisco CCNA, and CompTIA A+, Traceroute is a core topic. You must know the command syntax for different operating systems (tracert on Windows, traceroute on Linux), how to interpret the output, and how to use it in troubleshooting scenarios. Common exam traps include misinterpreting asterisks, confusing Traceroute with Ping, and misunderstanding the relationship between per-hop latency and actual link delays. The memory tip is to think of Traceroute as a road trip where each car has an expiration date, it can only go one hop before asking for directions. In real-world IT, Traceroute saves hours of troubleshooting by quickly isolating problems to the correct network segment, making it a must-have skill for any network professional.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/traceroute