traceroute

It sends probes with TTL 1, 2, 3…; each router that drops one for running out of TTL answers time exceeded, and so shows itself. The last line is the destination. * means no answer for that probe: a router that does not send ICMP, a firewall, or the point where the path breaks. Where the lines stop is where to look next.

traceroute command usage

traceroute [-n] [-q PROBES] [-w SECONDS] [-I] [-m MAXHOPS] ADDRESS

Options

-n

print addresses, skip name lookups (faster)

-q 1

one probe per hop instead of three

-w 2

wait 2 s for each answer

-I

probe with ICMP echo instead of UDP

-m 10

give up after 10 hops

traceroute examples

traceroute -n 10.0.3.10

Lists each router's address on the way to 10.0.3.10.

traceroute -q1 -w2 webServer.lab

Traces the path with one probe per hop, waiting two seconds for each.

traceroute -I -n 10.0.3.10

Traces with ICMP echo probes, which some firewalls let through when UDP is blocked.

traceroute -T -p 443 -n 10.0.3.10

Traces with TCP SYN probes to port 443, which pass firewalls that let only web traffic through (needs root).

traceroute -U -p 53 -n 10.0.3.10

Sends every UDP probe to port 53 instead of a changing high port.

traceroute -m 10 -n 10.0.3.10

Gives up after 10 hops instead of 30.

traceroute -f 3 -n 10.0.3.10

Starts at hop 3, skipping the routers you already know.

traceroute -6 -n webServer.lab

Traces the IPv6 path; traceroute6 does the same.

traceroute -i eth1 -n 10.0.3.10

Sends the probes out of eth1, to compare the paths of two uplinks.

traceroute -N 1 -n 10.0.3.10

Sends one probe at a time instead of 16 together, for routers that rate-limit their ICMP answers.

traceroute --mtu -n 10.0.3.10

Finds the largest packet each hop passes, and prints where the MTU shrinks.

traceroute -A -n example.com

Prints the autonomous system (AS) of each hop, to see which networks the path crosses.

mtr -n -r -c 10 10.0.3.10

Sends 10 rounds of probes and prints loss and delay per hop; loss at a middle hop that the last hop does not show is that router limiting its answers, not real loss.

HOST: laptop          Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 10.0.1.2        0.0%    10    0.4   0.4   0.3   0.6   0.1
  2.|-- 10.0.12.2      30.0%    10   12.1  11.8  10.9  13.0   0.7
  3.|-- 10.0.3.10       0.0%    10   12.4  12.2  11.1  13.4   0.6

Reading the output

$ traceroute -n -q1 -w2 10.0.2.10
traceroute to 10.0.2.10 (10.0.2.10), 30 hops max, 46 byte packets
 1  10.0.1.2  0.003 ms
 2  10.0.2.10  0.001 ms

• Line 1: the first router, your gateway. Line 2: the destination itself.
• The times are round trips to that hop: a jump between two lines shows the slow link.
• Lines of * to the end: the path stops after the last router that answered.

Pitfalls

• It shows the path there only: replies may come back another way.
• The address a router answers from is the card facing you, not always the one in its name.

Run it on real machines