Command by command
| Windows | Linux | What it gives you |
|---|---|---|
tracert 10.0.2.20 | traceroute 10.0.2.20 | Trace the path |
tracert -d 10.0.2.20 | traceroute -n 10.0.2.20 | Skip reverse DNS |
tracert -h 5 10.0.2.20 | traceroute -m 5 10.0.2.20 | Limit the hop count |
| traceroute -I 10.0.2.20 | Use ICMP, matching what tracert does |
| traceroute -T -p 443 10.0.2.20 | TCP probes — often the only ones a firewall allows |
What the output looks like
$ traceroute -n 10.0.2.20
1 10.0.1.1 0.412 ms 0.388 ms 0.371 ms
2 10.0.2.1 0.904 ms 0.881 ms 0.877 ms
3 10.0.2.20 1.201 ms 1.188 ms 1.164 msWhy the two differ
Both tools work the same way underneath: send a probe with TTL 1, collect the ICMP Time Exceeded reply that names the first router, then TTL 2, and so on. What differs is the probe. Windows uses ICMP Echo. Linux defaults to UDP aimed at unlikely high ports, expecting an ICMP Port Unreachable from the final host to signal arrival. Since firewalls commonly treat ICMP, UDP and TCP differently, the probe choice decides how far you get — which is why -I and -T exist.
The trap
Asterisks do not mean the path is broken. They mean that hop did not send back a Time Exceeded message, which many routers deliberately suppress or rate-limit. If the final line shows your destination, the path works — the gaps in the middle are silent routers, not failures. People escalate incidents over this regularly.
Common questions
Why does traceroute need root for -I or -T?
Sending raw ICMP or crafted TCP probes requires a raw socket, which is privileged. Default UDP mode uses an ordinary socket and needs no privileges, which is exactly why it is the default despite being the mode firewalls most often block.
Which is more accurate, tracert or traceroute?
Neither. Both infer the path from ICMP replies, and both can be misled by load balancing that sends successive probes down different paths, or by routers that reply from a different interface than the one the packet arrived on. Treat a traceroute as a strong hint, not a definitive map.
Stop reading, start running
Open the lab, go live, and run traceroute against real Linux networking in your browser. No install, no signup.