How to Read a Traceroute (And What It Actually Tells You)

Traceroute sends packets with incrementing TTL values — each packet expires at one more hop than the last, causing that router to send back an ICMP Time Exceeded message. By collecting these responses, traceroute maps the path your traffic takes across the network and measures the round-trip time to each hop.

Reading the Output

Each line in a traceroute represents one network hop. The number is the hop count, followed by the hostname (if reverse DNS resolves) and IP address, followed by three round-trip time measurements in milliseconds. Example: '5 ae-1.r01.londen03.uk.bb.gin.ntt.net (192.0.2.1) 8.543 ms 8.211 ms 9.102 ms' — you're at hop 5, on an NTT router in London, with about 8-9ms round-trip time.

Three measurements are shown because traceroute sends three probes per hop. The variation between them shows jitter. Wide variation (5ms, 5ms, 200ms) indicates congestion or an unstable link. Consistent measurements indicate a stable hop.

The Asterisk Problem

Asterisks (***) mean the probe timed out — no response was received from that hop. This doesn't necessarily mean the hop is broken. Many routers are configured to rate-limit or ignore ICMP TTL Exceeded messages to reduce load — the router forwards your traffic fine, it just doesn't bother responding to traceroute probes. Ignore asterisks in the middle of a traceroute if subsequent hops respond.

Asterisks at the end of a traceroute — where the destination should be — do mean something is wrong. Either the destination is firewalled, unreachable, or blocking ICMP entirely.

What Increased Latency at a Hop Means

Latency at each hop should be cumulative — each hop further away should add a few milliseconds. A sudden large increase (low latency for several hops, then a spike of 150ms) usually indicates a long-distance link at that point — an undersea cable, a transcontinental link, or a peering point between two continents.

That's the key insight about traceroutes — a hop showing higher latency than the hops after it isn't always a problem. Routers deprioritise generating ICMP TTL Exceeded messages (they're administrative traffic), so the ICMP response might be delayed even while regular traffic flows through quickly. Judge the destination latency and packet loss, not intermediate hop latency in isolation.

Windows Tracert vs Linux Traceroute: Different Tools, Same Idea

Windows uses tracert and sends ICMP Echo Requests (ping packets) with incrementing TTLs, not UDP. Linux and macOS use traceroute and default to UDP probes to high-numbered ports. The practical difference is that some networks filter UDP more aggressively than ICMP, or vice versa — meaning the same path might show different results on Windows versus Linux. If a hop appears missing on one OS but not the other, it's usually a filtering difference, not an actual routing difference.

Both tools also offer ICMP mode explicitly. 'traceroute -I' on Linux sends ICMP probes like Windows does. MTR on Windows can be installed via Winget and defaults to ICMP. For comparative troubleshooting — checking whether a routing issue affects a specific protocol — running traceroute in both UDP and ICMP mode and comparing results quickly tells you whether a filtering issue is protocol-specific.