How Traceroute Works
Traceroute discovers the path packets take by exploiting the IP TTL field: it sends probes with TTL=1, 2, 3…, and each router that decrements TTL to zero reports back with an ICMP "Time Exceeded" — revealing itself. Hop by hop, the route appears.
The TTL trick, step by step
Probe TTL=1 → first router drops it → ICMP Time Exceeded (router 1 revealed) Probe TTL=2 → second router drops it → ICMP Time Exceeded (router 2 revealed) ... Probe TTL=n → reaches destination → reply ends the trace
TTL (time-to-live) exists to stop packets looping forever: every router subtracts 1 and discards at zero, sending the ICMP error that traceroute turns into a map. Three probes per TTL give you three latency samples per hop.
Windows tracert vs Linux traceroute
Same trick, different probes: Windows tracert sends ICMP echo requests; Linux traceroute defaults to UDP packets to high ports (add -I for ICMP). That's why the same path can show different behaviour from different tools — some routers or firewalls treat ICMP and UDP differently.
Reading the output like an engineer
- Latency jumps between hops locate distance or congestion — a 2ms→180ms step usually means an undersea/continental link.
* * *means no reply — usually a router that deprioritises or blocks ICMP replies, not necessarily a failure. If later hops answer, the path is fine.- The trace dying at hop N and never completing points the fault between hop N and the destination — the core skill in no-internet troubleshooting.
Caveats worth knowing
Return paths can differ from forward paths, load-balanced networks can show different routers per probe, and low per-hop responses only measure the router's ICMP generation, not its forwarding speed. Traceroute is a map, not a speedometer.
Frequently asked questions
How does traceroute discover each router?
It sends probes with increasing TTL values. Each router that decrements TTL to zero discards the probe and returns an ICMP Time Exceeded message, revealing its address — TTL=1 exposes the first router, TTL=2 the second, and so on.
What do the asterisks (* * *) in traceroute mean?
That hop didn't reply within the timeout — usually a router configured to ignore or rate-limit ICMP. If subsequent hops respond, traffic is flowing fine through it.
What is the difference between tracert and traceroute?
Windows tracert uses ICMP echo probes; Linux traceroute defaults to UDP probes to high ports (with -I for ICMP). The TTL mechanism is identical.
Why does latency sometimes decrease at a later hop?
Per-hop times measure each router's ICMP reply generation, which routers deprioritise differently. Only end-to-end latency to the destination is a dependable number.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.