Traceroute (known as tracert on Windows) is a network diagnostic tool used to track the exact pathway a packet takes from your computer to a destination server. While ping tells you if a destination is reachable, traceroute tells you how the packet gets there, documenting every router (hop) along the path.
If your connection to a website is slow or failing, traceroute is the ultimate tool for pinpointing exactly which router or ISP in the chain is causing the problem.
How Does Traceroute Work?
Traceroute is a clever exploitation of the TTL (Time To Live) field in the IP header. The TTL prevents packets from looping infinitely in a broken network. Every time a packet passes through a router, the router decreases the TTL by 1. If the TTL hits 0, the router discards the packet and sends an ICMP "Time Exceeded" message back to the sender.
Traceroute intentionally sends packets with artificially low TTLs to discover the path:
- It sends a packet with TTL=1. The very first router (your default gateway) drops it and replies "Time Exceeded." Traceroute now knows the IP of Hop 1.
- It sends a packet with TTL=2. The first router passes it, but the second router drops it and replies. Traceroute now knows Hop 2.
- It sends a packet with TTL=3. The third router drops it and replies, revealing Hop 3.
- This process repeats, incrementing the TTL, until the packet finally reaches the destination, which responds with a standard Reply.
Note: Windows tracert uses ICMP Echo Requests by default. Linux/macOS traceroute uses UDP packets by default.
Understanding Traceroute Output
Here is an example of a typical Windows tracert output:
How to Read the Columns:
- Hop Number (1, 2, 3...): The number of routers the packet has traversed.
- Latency (ms): Traceroute sends three probes per hop by default. These three columns show the round-trip time for each probe. This helps identify intermittent latency spikes.
- Hostname / IP Address: The name and IP address of the router at that hop. If DNS resolves the name, it is displayed (e.g.,
cr01.regional.isp.net), which provides valuable clues about where the router is geographically or which ISP owns it.
Common Troubleshooting Scenarios
1. The Asterisks (* * *) / Request Timed Out
If you see a row with three asterisks (like Hop 5 in the example above), it means that specific router did not send an ICMP "Time Exceeded" reply within the timeout period.
Is this a problem? Usually, NO. Many enterprise routers and backbone internet routers are configured to intentionally drop or deprioritize ICMP traffic to save CPU cycles or for security reasons. If the hops after the asterisks continue successfully (like Hop 6 above), the network is perfectly healthy. The router simply ignored the traceroute probe but still routed the actual traffic.
2. The Trace Stops Completely
If the trace hits Hop 4, and then Hop 5, 6, 7, and all subsequent hops are asterisks until the trace fails, you have found where the connection is breaking. The router at Hop 4 is the last known good device. The issue is likely the link between Hop 4 and Hop 5.
3. High Latency Spikes
If Hops 1 through 3 have ~20ms latency, but Hop 4 jumps to ~200ms, and all subsequent hops remain at ~200ms or higher, you have identified a bottleneck. The link or router at Hop 4 is heavily congested or physically distant (like an undersea cable crossing an ocean).
For more on diagnosing delays, check out Network Latency Troubleshooting and the Network Troubleshooting Workflow.
Useful Commands
Windows
tracert google.com: Standard trace up to 30 hops.tracert -d google.com: Do not resolve IP addresses to hostnames. This makes the trace run much faster because it skips DNS lookups for every router.
Linux / macOS
traceroute google.com: Standard UDP-based trace.traceroute -I google.com: Force traceroute to use ICMP instead of UDP (often bypasses firewalls that block UDP probes). Requires root/sudo.
Quick Summary
- Traceroute maps the exact router-by-router path to a destination.
- It works by intentionally expiring the TTL (Time To Live) field in packets.
- Asterisks in the middle of a trace are normal and just mean a router is hiding from ICMP traffic.
- Asterisks at the end of a trace indicate exactly where the connection is failing.