Quick Summary
- Traceroute lists every router (hop) on the path to a destination, in order, with round-trip times
- It works by sending probes with TTL=1, then 2, then 3 -- each router that drops an expired packet reveals itself via an ICMP Time Exceeded message
- An asterisk (*) just means no reply within the timeout -- usually normal, not a sign of a break
The One-Stop-Farther Letter Analogy
Imagine you want to map every post office between your house and a friend across the country, but you have no map. So you try a trick. You mail a letter with a strict instruction on the envelope: "You may travel exactly one stop, then stop and mail me a note saying where you are." The first post office receives it, sees its limit is used up, and mails you back a postcard with its own address.
Now you send a second letter, this time allowed to travel two stops. It sails past the first office and the second one mails you back. Then three stops, then four. Each letter goes one stop farther than the last, and every office that has to "give up" tells you where it is. String the postcards together and you have mapped the entire route -- one stop at a time.
That is exactly how traceroute works. The "you may travel N stops" instruction is a real field in every IP packet called the TTL (Time To Live). Every router that forwards a packet decrements the TTL by 1. When a router decrements the TTL to 0, it drops the packet and politely mails back an ICMP "Time Exceeded" message (Type 11) -- which conveniently reveals that router's IP address.
By sending probes with TTL=1, then TTL=2, then TTL=3, and so on, traceroute forces each successive router along the path to expire one probe and announce itself. The result is an ordered list of hops from your doorstep all the way to the destination.
The TTL Trick, Visualized
Here are three rounds of probes. Watch the TTL countdown: each router subtracts 1, and whichever router hits 0 sends back an ICMP Time Exceeded that exposes its address.
Traceroute Simulator
Press Run traceroute to watch probes go out one TTL at a time. Each hop replies with an IP and three round-trip times -- and one hop stays silent to show you that * * * is perfectly normal.
The IP addresses and times below are illustrative, for teaching only.
Look at hop 3 in the simulation: * * * Request timed out. That router simply chose not to
answer -- and that is completely normal. The trace happily continues to hop 4 and beyond. A silent hop
almost never means the path is broken.
Traceroute Step by Step
Send a Probe with TTL = 1
Traceroute launches its first probe toward the destination but sets the TTL to 1. The very first router on the path (usually your default gateway) receives it, decrements the TTL to 0, and must drop the packet. Crucially, it does not drop it silently -- it sends back an ICMP Time Exceeded (Type 11), and that reply's source address is the router's IP. Hop 1 is now revealed.
Increase the TTL, One at a Time
Next, traceroute sends a probe with TTL = 2. The first router decrements it to 1 and forwards it; the second router decrements it to 0 and replies with its own ICMP Time Exceeded. Then TTL = 3 exposes the third router, and so on. Each round reaches exactly one hop farther than the last, so the routers are discovered in order, building the path step by step.
Probe Each Hop and Time It
For each TTL, traceroute usually sends three probes and measures the round-trip time
for each, which is why you see three numbers per line. If a probe gets no reply before the timeout,
you see a * in its place. Three asterisks (* * *) just mean all three
probes for that hop went unanswered -- often because that router rate-limits or suppresses ICMP.
The Destination Replies Differently
Eventually a probe carries a TTL large enough to actually reach the destination. The
destination does not send Time Exceeded -- it responds in its own way. Classic Unix
traceroute sends UDP to an unlikely high port and gets back ICMP
Destination/Port Unreachable (Type 3). Windows tracert sends ICMP Echo Requests
and gets ICMP Echo Replies. Either way, that final reply tells traceroute it has
arrived, and the trace stops.
Traceroute in the Real World
Here are three of the tools and situations where traceroute earns its keep:
traceroute (Linux/macOS)
The classic command. By default it sends UDP probes to high ports and relies on ICMP Time Exceeded for intermediate hops and Port Unreachable from the destination. You can switch it to ICMP or TCP probes with flags when a firewall blocks UDP.
tracert (Windows)
The Windows equivalent. It sends ICMP Echo Requests instead of UDP, so the destination answers with an Echo Reply. Same TTL trick, same hop-by-hop output -- just a different default probe type, which is why results can differ slightly from Unix traceroute.
mtr (continuous)
mtr combines traceroute and ping into a live, continuously updating view. It keeps probing
every hop and shows per-hop loss and latency over time, making it far better than a single traceroute
for spotting an intermittent problem along the path.
Common Misreadings of a Traceroute
Traceroute output is easy to misinterpret. Avoid these classic traps:
Assuming * * * Means a Break
A line of asterisks does not mean the path is down. Many routers are configured to not
send ICMP at all, or to rate-limit it. If later hops still reply, the traffic is clearly getting
through -- that one hop is just quiet. Only treat * * * as a problem if it appears at the
final destination and stays there.
Blaming the Hop with High Latency
A single hop showing a big round-trip time is often not the culprit. ICMP replies are generated at low priority, so a busy router may be slow to answer your probe while still forwarding real traffic instantly. Look for latency that rises and stays high across all the following hops, not a one-off spike.
Forgetting the Return Path
Traceroute only shows the forward path your probes take. The replies may come back by a completely different route, and on the internet, paths are often asymmetric. So a slow or odd-looking hop might actually reflect the return journey, which traceroute never displays.
Why It Relies on ICMP
The whole mechanism leans on ICMP, the Internet Control Message Protocol -- the network's built-in messaging system for errors and diagnostics. The "Time Exceeded" (Type 11) message is what each expiring router sends back, and "Destination Unreachable" (Type 3) is one way the final host signals arrival. Because ICMP is sometimes filtered or deprioritized for security and performance reasons, traceroute results can be incomplete even when the actual data path is perfectly healthy. That is a feature of how the internet treats diagnostic traffic, not a flaw in your connection.
What Traceroute Is Really Telling You
Used well, traceroute answers a very specific question: "What route does my traffic take, and where along it does latency climb or do replies stop?" It is the natural next step after a ping. Ping tells you whether the destination is reachable at all; traceroute shows you the journey and helps you guess where a slowdown might live -- while always reminding you that silent hops and asymmetric return paths make the picture fuzzier than it first appears.
The bottom line: traceroute is a beautifully simple idea built on one field in the IP header. Send packets that are each allowed to travel one stop farther than the last, collect the "I had to give up here" notes that routers mail back, and you have a map of the path -- asterisks, caveats, and all.
Frequently asked questions about traceroute
What is traceroute and how does it work?
Traceroute discovers the routers along the path to a destination by exploiting the IP TTL field. It sends probes with TTL=1, then 2, then 3, and so on. Each router that forwards a packet decrements the TTL by 1; when a router decrements it to 0 it drops the packet and returns an ICMP Time Exceeded message, which reveals that router's IP address. Increasing the TTL one at a time reveals each router along the path in order.
What is TTL and why does traceroute change it?
TTL stands for Time To Live, a field in every IP packet that limits how many hops it may travel. Every router that forwards the packet decrements the TTL by 1, and when it reaches 0 the packet is dropped to prevent it looping forever. Traceroute deliberately starts the TTL at 1 and increases it by one for each round so that a different, successively farther router is forced to expire and reply with each probe.
Why do I see asterisks (* * *) in a traceroute?
An asterisk means no reply arrived within the timeout for that probe. This is often completely normal: a router may be configured not to send ICMP, may rate-limit ICMP replies, or a single probe may simply have been lost. Because ICMP responses are low priority, asterisks or rising latency at one hop do not necessarily mean that hop is broken or is where a problem lies.
What is the difference between traceroute and ping?
Ping tests whether a single destination is reachable and how long the round trip takes, giving you one answer. Traceroute maps the whole path by listing each router (hop) between you and the destination, along with the round-trip time to each one. Ping tells you if the destination is up; traceroute tells you the route taken and where along it latency rises or packets stop.
What is the difference between tracert and traceroute?
They are the same tool on different platforms with a different default probe type. On Linux and macOS the command is traceroute and classically sends UDP packets to an unlikely high port, expecting an ICMP Port Unreachable from the destination. On Windows the command is tracert and sends ICMP Echo Requests, expecting ICMP Echo Replies. Both still rely on the TTL trick and ICMP Time Exceeded for the intermediate hops.
Trace a path yourself
You just learned how the TTL trick exposes every router on a path. Now run traceroute across a multi-hop lab, see where the path stops, fix what you find, and run it again. Press Go Live and the same command runs as the real Linux traceroute.
Launch the network lab →