When your connection is slow, where is the bottleneck? Traceroute answers this by revealing every router between you and your destination. Understanding its output is essential for network troubleshooting.

How Traceroute Works: TTL Manipulation

Every IP packet has a Time To Live (TTL) field. Each router decrements this by 1. When TTL reaches 0, the router discards the packet and sends back an ICMP "Time Exceeded" message.

Traceroute exploits this:

  1. Send packet with TTL=1 → First router replies with Time Exceeded
  2. Send packet with TTL=2 → Second router replies
  3. Continue until destination reached (ICMP Echo Reply or Port Unreachable)

Reading Traceroute Output

Each line shows: hop number, router IP/hostname, and three round-trip times (RTT).

Asterisks (*) mean no response. Possible causes: router configured not to respond to ICMP, rate limiting, or firewall blocking. Missing hops do not necessarily mean a problem if subsequent hops respond.

Identifying AS Boundaries

Use traceroute -A or mtr -z to show Autonomous System (AS) numbers. When the AS changes, you have crossed from one network to another.

This is crucial for identifying where latency spikes occur — inside your ISP, at a peering point, or in the destination network.

UDP vs ICMP vs TCP Traceroute

  • UDP (default on Linux): Sends to high port numbers. May be blocked by firewalls.
  • ICMP (default on Windows): Uses Echo Request. Often blocked by security policies.
  • TCP SYN: Uses tcptraceroute. Better at reaching servers that block ICMP/UDP.

Looking Glass: Traceroute from the Other Side

Looking Glass servers let you run traceroute FROM major ISPs and data centers. This shows the reverse path and helps identify asymmetric routing issues.

Popular Looking Glass sites: HE.net, Cogent, GTT, and most large ISPs offer public access.

MTR: Traceroute on Steroids

MTR combines traceroute with continuous ping. It shows packet loss and jitter at each hop over time — far more useful than a single traceroute snapshot.

Run: mtr -r -c 100 example.com for a report after 100 packets.