traceroute

traceroute sends probes with increasing IPv4 TTL or IPv6 Hop Limit values. Routers where the value expires can return Time Exceeded messages, revealing some responding points along the forward path.

How Hop Discovery Works

Probes begin with a hop limit of one and increase. The first router decrements one to zero and can return an ICMP error. A limit of two reaches the second router before expiring, and the process continues until the destination responds or the maximum is reached.

Probe Methods

Traditional Linux traceroute commonly sends UDP probes to high destination ports. The destination can signal completion with ICMP Port Unreachable. Options can instead use ICMP Echo or TCP SYN probes, which can traverse filtering differently:

$ traceroute -n example.com
$ traceroute -I -n example.com
$ traceroute -T -p 443 -n example.com

Privileges and supported options vary. Use methods authorized for the target, and record the method when comparing results.

Interpreting Asterisks

An asterisk means no response was observed for that probe before timeout. The router may forward transit traffic while filtering or rate-limiting diagnostic responses. If later hops answer, the silent hop clearly forwarded at least some probes.

Timing and Path Variation

Per-hop times measure round trips to control responses, not latency added by the link between adjacent printed lines. Routers can deprioritize control-plane replies. Load balancing can send probes through different paths, and name resolution can add display delay; -n avoids reverse lookups.

The return route for each ICMP response can differ from the forward route. Repeat tests and correlate with endpoint application timing before identifying a bottleneck.

Comparing with the Application

A traceroute can reach the destination while the service is blocked, and the service can work while intermediate routers hide their responses. Test the same address family, destination, transport protocol, and port as the application, then use traceroute as supporting path evidence.

Summary

You can now interpret traceroute as a series of bounded-hop probes, not a complete path oracle.

1. Explain hop discovery through TTL or Hop Limit expiration.
2. Record whether UDP, ICMP, or TCP probes were used.
3. Treat asterisks as missing responses rather than proven outages.
4. Avoid deriving exact link latency from adjacent hop RTTs.
5. Correlate path evidence with the real application.