Cisco "traceroute" Command Explained
traceroute — reveals the router-by-router path packets take to a destination, using expiring TTLs to make each hop identify itself. Runs in user or privileged EXEC mode.
Syntax and common variants
| Variant | Purpose |
|---|---|
traceroute 8.8.8.8 | Trace the path hop by hop |
traceroute 10.1.1.1 source gi0/1 | Trace from a specific source |
traceroute (no args) | Extended interactive options |
Reading the output
| Output / element | Meaning |
|---|---|
1 10.0.0.1 2 ms | Hop number, router address, response times |
* * * | A hop not replying (rate-limited or filtered) — path may still work |
!H | Host unreachable from that hop — the break point |
When to use it
When ping fails, traceroute shows WHERE: the last responding hop borders the failure. Also exposes suboptimal or asymmetric paths ("why is traffic going via that site?"). Stars mid-path are often just rate-limited routers — judge by whether later hops reply. Browse more in the command reference or practise in the free labs.
Frequently asked questions
How does traceroute actually work?
It sends probes with TTL 1, 2, 3…; each router that expires a probe returns an ICMP time-exceeded, revealing itself as that hop.
Do * * * entries mean the path is broken?
Not necessarily — many routers rate-limit or block ICMP replies; if later hops answer, the path is fine.
Why does the path look different in each direction?
Routing is per-direction — asymmetric paths are normal and traceroute from each end shows its own view.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.