How to Read a Traceroute (And What It Actually Tells You)

Traceroute sends packets with incrementing TTL values — each packet expires at one more hop than the last, causing that router to send back an ICMP Time Exceeded message. By collecting these responses, traceroute maps the path your traffic takes across the network and measures the round-trip time to each hop.

Reading the Output

Each line in a traceroute represents one network hop. The number is the hop count, followed by the hostname (if reverse DNS resolves) and IP address, followed by three round-trip time measurements in milliseconds. Example: '5 ae-1.r01.londen03.uk.bb.gin.ntt.net (192.0.2.1) 8.543 ms 8.211 ms 9.102 ms' — you're at hop 5, on an NTT router in London, with about 8-9ms round-trip time.

Three measurements are shown because traceroute sends three probes per hop. The variation between them shows jitter. Wide variation (5ms, 5ms, 200ms) indicates congestion or an unstable link. Consistent measurements indicate a stable hop.

The Asterisk Problem

Asterisks (***) mean the probe timed out — no response was received from that hop. This doesn't necessarily mean the hop is broken. Many routers are configured to rate-limit or ignore ICMP TTL Exceeded messages to reduce load — the router forwards your traffic fine, it just doesn't bother responding to traceroute probes. Ignore asterisks in the middle of a traceroute if subsequent hops respond.

Asterisks at the end of a traceroute — where the destination should be — do mean something is wrong. Either the destination is firewalled, unreachable, or blocking ICMP entirely.

What Increased Latency at a Hop Means

Latency at each hop should be cumulative — each hop further away should add a few milliseconds. A sudden large increase (low latency for several hops, then a spike of 150ms) usually indicates a long-distance link at that point — an undersea cable, a transcontinental link, or a peering point between two continents.

Here's the thing — a hop showing higher latency than the hops after it isn't always a problem. Routers deprioritise generating ICMP TTL Exceeded messages (they're administrative traffic), so the ICMP response might be delayed even while regular traffic flows through quickly. Judge the destination latency and packet loss, not intermediate hop latency in isolation.