The idea: make each router reveal itself

No router tells you the path a packet takes. But every router does one thing to every packet: it subtracts 1 from the TTL (time to live) field of the IP header, and if the TTL reaches 0 it drops the packet and sends an ICMP Time Exceeded message back to the sender, from its own address. traceroute uses this on purpose. It sends probes with TTL 1, then TTL 2, then TTL 3, and so on. The probe with TTL k dies at the k-th router, and that router's answer gives away its address.

Time runs down. The laptop sends a probe with TTL 1; R1 drops it and answers Time Exceeded. Then TTL 2: R1 forwards it with TTL 1, R2 drops it and answers Time Exceeded. Then TTL 3 dies at R3 (TTL 4, not drawn, dies at R4). The probe with TTL 5 reaches example.net, which answers Port Unreachable, and traceroute stops.
Each new TTL reaches one router further; the destination's different answer ends the trace.

The canvas traces the path from a laptop to example.net through four routers: the home router R1, the ISP's router R2, the ISP's core router R3 and R4 at the server's provider. The link from R3 to R4 is a long-haul cable of 45 ms. traceroute sends 3 probes per TTL (-q 3) and gives up after 7 hops here (-m 7; the real default is 30). The first probe of each TTL is animated; the other two are added to the same output line.

One probe, step by step

  1. The laptop sends the probe with TTL k and notes the time.
  2. Each router on the way gets the TTL, subtracts 1 and forwards it (Demo 1 shows the TTL going down on the canvas).
  3. The router that gets TTL 1 would forward it with TTL 0, which is not allowed. It drops the probe and answers ICMP type 11, code 0: "time to live exceeded in transit" (Demo 2).
  4. The ICMP message carries the IP header and the first 8 bytes of the dropped probe. traceroute uses them (the UDP port, or the Echo sequence number) to know which probe the answer belongs to.
  5. The time between sending and the answer is the round-trip time printed on the line.

Every router does this check for every packet anyway; see How a Router Forwards a Packet for the TTL step inside a router, and the full ICMP error table.

How traceroute knows it has arrived

The destination is a host, not a router: it does not decrement the TTL of a packet addressed to itself, so it never sends Time Exceeded. It answers the probe itself, and that different answer tells traceroute to stop. What it answers depends on the kind of probe.

ProbeUsed byRouters answerDestination answers
UDP to port 33434, 33435, … (nothing listens there)Linux / macOS tracerouteTime Exceeded (11/0)Port Unreachable (3/3)
ICMP Echo RequestWindows tracert, traceroute -ITime Exceeded (11/0)Echo Reply (0/0)
TCP SYN to an open porttraceroute -T -p 443, tcptracerouteTime Exceeded (11/0)SYN-ACK (or RST if closed)

The UDP port goes up by one for every probe (33434 + probe number), so each answer can be matched to its probe even when answers arrive out of order. Demo 4 runs the same trace with ICMP Echo probes.

Reading the times

Each time is measured at the laptop: the probe's way there plus the answer's way back, plus the moment the router needs to build the ICMP message. It is not the time of one link. To find a slow link, compare neighbouring lines: here hop 3 takes about 19 ms and hop 4 about 109 ms, because the 45 ms cable between them is crossed twice.

Two bar charts of average round-trip time per hop. Left, a real slow link: 1.5, 9.5, 19.5, 109.5, 111.5 ms; the jump at hop 4 stays on hop 5. Right, a busy router: hop 2 is 63 ms but hop 3 is back to 19.5 ms, so the spike is the router, not the path.
A rise that stays on every later hop is a real delay; a spike that disappears at the next hop is a busy router.

Routers forward packets in fast hardware, but they build ICMP messages on their CPU, often at low priority and with a rate limit. A busy router can take 50 ms to answer while forwarding everyone's traffic at full speed. Its line looks slow, but the next line is fast again (Demo 5). Only a rise that stays on all later hops means the path is slower.

Stars: * * *

A * means no answer came within the wait time (-w, 5 s on Linux). Three stars on one line usually mean that router does not send Time Exceeded at all: its operator blocks or rate-limits ICMP. The router still forwards packets, so the next line answers normally (Demo 3). Stars only matter when every later line is stars too.

Stars at the end are different. If the destination's firewall drops the probes, the trace never sees the final answer and goes on printing * * * up to the maximum number of hops. Switching to ICMP or TCP probes to an open port usually gets through (Demo 6).

Relatives of traceroute

  • mtr runs traceroute over and over and shows loss and latency per hop. Loss on one hop alone is again usually ICMP rate limiting.
  • Paris traceroute keeps the probe's flow fields the same, so routers that spread flows over several paths (ECMP) send every probe the same way. Classic traceroute changes the port and can mix several paths into one output.
  • IPv6 works the same way with the Hop Limit field and ICMPv6 Time Exceeded (type 3).

See Internet Protocol Layers for where IP, ICMP and UDP sit in the stack and how the TTL changes as a packet crosses routers.

What the page leaves out

  • The return path: the answer may come back by another route, so a time can include a detour the trace never shows.
  • Several paths per hop (ECMP), where one line can list two or three different routers.
  • MPLS tunnels that hide routers, NAT, and routers that answer from an address on another interface.
  • Reverse DNS names (traceroute prints them unless you pass -n) and AS numbers.
  • Probes sent in parallel: real traceroute sends several TTLs at once to finish faster.