traceroute is the classic network diagnostic tool for tracing the route packets take across an IP network. It sends packets with increasing TTL (Time To Live) values to discover each router hop between source and destination. Unlike tracepath, traceroute offers extensive protocol options and advanced features but typically requires root privileges for full functionality.
Protocol Options
Protocol
Option
Root Required
Best Use Case
UDP
Default (none)
No
General purpose tracing
ICMP
-I
Yes
Firewall traversal, Windows-style
TCP
-T
Yes
Testing specific services, bypass filters
UDP (IPv6)
-6
No
IPv6 networks
Important: Many traceroute features require root privileges. Use sudo for ICMP and TCP modes, and for setting source address or port options.
Example 1: Basic UDP Traceroute (Default Mode)
traceroute google.com
traceroute to google.com (142.250.185.46), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) 0.892 ms 0.856 ms 0.823 ms
2 10.20.30.1 (10.20.30.1) 2.456 ms 2.423 ms 2.398 ms
3 isp-gateway.net (72.14.197.1) 8.234 ms 8.198 ms 8.167 ms
4 core-router-1.isp.net (209.85.243.189) 15.678 ms 15.645 ms 15.612 ms
5 core-router-2.isp.net (108.170.252.1) 18.345 ms 18.312 ms 18.278 ms
6 peer-exchange.net (108.170.252.33) 22.567 ms 22.534 ms 22.501 ms
7 lga25s61-in-f14.1e100.net (142.250.185.46) 25.123 ms 25.089 ms 25.056 ms
Explanation:
The default traceroute mode uses UDP packets with incrementing destination ports (starting at 33434). Three probes are sent per hop for reliability.
30 hops max: Default maximum TTL value
60 byte packets: Default packet size
Three times per hop: Shows min, typical, and max RTT
Hostname resolution: Automatically resolves IP addresses
UDP ports: Typically starts at port 33434
Example 2: ICMP Echo Mode (Windows-Style)
sudo traceroute -I google.com
traceroute to google.com (142.250.185.46), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) 0.923 ms 0.891 ms 0.867 ms
2 10.20.30.1 (10.20.30.1) 2.567 ms 2.534 ms 2.512 ms
3 isp-gateway.net (72.14.197.1) 8.456 ms 8.423 ms 8.398 ms
4 core-router-1.isp.net (209.85.243.189) 15.890 ms 15.856 ms 15.834 ms
5 core-router-2.isp.net (108.170.252.1) 18.567 ms 18.534 ms 18.512 ms
6 peer-exchange.net (108.170.252.33) 22.789 ms 22.756 ms 22.734 ms
7 lga25s61-in-f14.1e100.net (142.250.185.46) 25.345 ms 25.312 ms 25.289 ms
Explanation:
Uses ICMP Echo Request packets (like ping) instead of UDP. This mode is similar to Windows tracert and may work better through some firewalls.
-I flag: ICMP Echo mode (requires root)
sudo required: ICMP raw sockets need privileges
Firewall friendly: Many allow ICMP, block UDP
Windows compatible: Same method as tracert.exe
More reliable: Through restrictive firewalls
Example 3: TCP SYN Mode for Firewall Traversal
sudo traceroute -T -p 443 google.com
traceroute to google.com (142.250.185.46), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) 0.912 ms 0.878 ms 0.856 ms
2 10.20.30.1 (10.20.30.1) 2.623 ms 2.589 ms 2.567 ms
3 isp-gateway.net (72.14.197.1) 8.512 ms 8.478 ms 8.456 ms
4 core-router-1.isp.net (209.85.243.189) 15.945 ms 15.912 ms 15.889 ms
5 core-router-2.isp.net (108.170.252.1) 18.623 ms 18.589 ms 18.567 ms
6 peer-exchange.net (108.170.252.33) 22.845 ms 22.812 ms 22.789 ms
7 lga25s61-in-f14.1e100.net (142.250.185.46) 25.401 ms 25.367 ms 25.345 ms
Explanation:
Uses TCP SYN packets to destination port 443 (HTTPS). Excellent for tracing through firewalls that block UDP and ICMP but allow web traffic.
-T flag: TCP SYN mode (requires root)
-p 443: Destination port (HTTPS)
Firewall evasion: Appears as legitimate HTTPS connection
Port-specific: Tests path to specific service
Best for: Heavily filtered networks
Tip: Use TCP mode with port 80 or 443 when UDP and ICMP are blocked. Most firewalls allow web traffic through.
Example 4: Numeric Output (No DNS Resolution)
traceroute -n 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 192.168.1.1 0.892 ms 0.856 ms 0.823 ms
2 10.20.30.1 2.456 ms 2.423 ms 2.398 ms
3 72.14.197.1 8.234 ms 8.198 ms 8.167 ms
4 209.85.243.189 15.678 ms 15.645 ms 15.612 ms
5 108.170.252.1 18.345 ms 18.312 ms 18.278 ms
6 108.170.252.33 22.567 ms 22.534 ms 22.501 ms
7 8.8.8.8 25.123 ms 25.089 ms 25.056 ms
Explanation:
Displays only numeric IP addresses without attempting DNS reverse lookups. Much faster when DNS is slow or unavailable.
-n flag: Numeric mode, skip DNS
Faster execution: No DNS lookup delays
DNS problems: Works when DNS is broken
Scripting: Easier to parse in scripts
Baseline testing: Eliminates DNS variable
Example 5: Adjust Packet Size and Wait Time
traceroute -q 5 -w 2 -N 1 example.com
traceroute to example.com (93.184.216.34), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) 0.934 ms 0.912 ms 0.889 ms 0.867 ms 0.845 ms
2 10.20.30.1 (10.20.30.1) 2.678 ms 2.645 ms 2.623 ms 2.601 ms 2.578 ms
3 isp-gateway.net (72.14.197.1) 8.567 ms 8.534 ms 8.512 ms 8.489 ms 8.467 ms
4 core-router.isp.net (209.85.243.189) 15.987 ms 15.956 ms 15.934 ms 15.912 ms 15.889 ms
Explanation:
Customizes traceroute behavior with multiple options for more thorough or faster testing.
-q 5: Send 5 queries per hop (instead of default 3)
-w 2: Wait 2 seconds for response (default is 5)
-N 1: Simultaneous probes (speeds up trace)
More data points: Better statistical picture
Faster completion: With simultaneous probes
Example 6: Set Maximum Hops and First TTL
traceroute -m 15 -f 3 google.com
traceroute to google.com (142.250.185.46), 15 hops max, 60 byte packets
3 isp-gateway.net (72.14.197.1) 8.234 ms 8.198 ms 8.167 ms
4 core-router-1.isp.net (209.85.243.189) 15.678 ms 15.645 ms 15.612 ms
5 core-router-2.isp.net (108.170.252.1) 18.345 ms 18.312 ms 18.278 ms
6 peer-exchange.net (108.170.252.33) 22.567 ms 22.534 ms 22.501 ms
7 lga25s61-in-f14.1e100.net (142.250.185.46) 25.123 ms 25.089 ms 25.056 ms
Explanation:
Limits maximum hops and skips initial hops you already know about.
-m 15: Maximum of 15 hops (default 30)
-f 3: Start with TTL of 3 (skip first 2 hops)
Faster results: When destination is nearby
Skip known hops: Focus on problematic segment
Local network: Useful in controlled environments
Example 7: IPv6 Traceroute
traceroute -6 google.com
traceroute to google.com (2607:f8b0:4004:c08::8b), 30 hops max, 80 byte packets
1 2001:db8:1::1 (2001:db8:1::1) 1.234 ms 1.198 ms 1.167 ms
2 2001:db8:2::1 (2001:db8:2::1) 3.456 ms 3.423 ms 3.398 ms
3 2001:db8:3::1 (2001:db8:3::1) 9.123 ms 9.089 ms 9.056 ms
4 2001:4860:0:1::1 (2001:4860:0:1::1) 16.789 ms 16.756 ms 16.723 ms
5 2001:4860:0:1::2 (2001:4860:0:1::2) 19.234 ms 19.201 ms 19.178 ms
6 2607:f8b0:4004:c08::8b (2607:f8b0:4004:c08::8b) 27.567 ms 27.534 ms 27.512 ms
Explanation:
Forces IPv6 mode to trace the IPv6 path to the destination. IPv6 routes often differ from IPv4 routes.
-6 flag: Use IPv6 only
80 byte packets: IPv6 default packet size
Different routing: IPv6 may take different path than IPv4
Modern networks: Essential for IPv6 troubleshooting
Dual-stack: Compare with IPv4 path using -4
Example 8: AS Number Lookup
traceroute -A google.com
traceroute to google.com (142.250.185.46), 30 hops max, 60 byte packets
1 router.local (192.168.1.1) [*] 0.892 ms 0.856 ms 0.823 ms
2 10.20.30.1 (10.20.30.1) [*] 2.456 ms 2.423 ms 2.398 ms
3 isp-gateway.net (72.14.197.1) [AS7018] 8.234 ms 8.198 ms 8.167 ms
4 core-router-1.isp.net (209.85.243.189) [AS15169] 15.678 ms 15.645 ms 15.612 ms
5 core-router-2.isp.net (108.170.252.1) [AS15169] 18.345 ms 18.312 ms 18.278 ms
6 peer-exchange.net (108.170.252.33) [AS15169] 22.567 ms 22.534 ms 22.501 ms
7 lga25s61-in-f14.1e100.net (142.250.185.46) [AS15169] 25.123 ms 25.089 ms 25.056 ms
Explanation:
Displays the Autonomous System (AS) number for each hop, showing which organizations control each network segment.
-A flag: Enable AS path lookups
[AS15169]: Google's AS number
[AS7018]: AT&T's AS number (example)
[*]: Private network, no public AS
Network analysis: See where traffic crosses ISP boundaries
BGP routing: Understand inter-domain routing
Note: AS lookups require external queries and may slow down the trace slightly. Useful for understanding internet routing topology.
traceroute to remote-server.com (203.0.113.50), 30 hops max, 60 byte packets
1 gateway.eth1 (10.0.1.1) 0.923 ms 0.889 ms 0.867 ms
2 next-hop.provider (198.51.100.1) 3.567 ms 3.534 ms 3.512 ms
3 core-1.provider (198.51.100.10) 8.923 ms 8.889 ms 8.867 ms
4 core-2.provider (198.51.100.20) 15.234 ms 15.201 ms 15.178 ms
5 edge.provider (198.51.100.30) 22.567 ms 22.534 ms 22.512 ms
6 remote-server.com (203.0.113.50) 28.890 ms 28.856 ms 28.834 ms
Explanation:
Specifies source IP address and network interface for multi-homed systems with multiple network connections.
VPN testing: Force traffic through specific tunnel
Load balancing: Verify path from each interface
Example 10: Comprehensive Troubleshooting Session
# First: Quick UDP trace
traceroute -n problematic-server.com
# Second: Try ICMP if UDP times out
sudo traceroute -I -n problematic-server.com
# Third: Try TCP to specific port
sudo traceroute -T -p 80 -n problematic-server.com
# Fourth: Detailed with AS info
traceroute -A problematic-server.com
# Fifth: Test return path (from remote server)
# ssh user@problematic-server.com "traceroute my-ip-address"
# UDP trace result:
5 * * *
6 * * *
7 * * *
# ICMP trace result:
5 router-5.isp.net 23.456 ms 23.423 ms 23.398 ms
6 router-6.isp.net 28.567 ms 28.534 ms 28.512 ms
7 problematic-server.com 32.789 ms 32.756 ms 32.734 ms
# TCP trace confirms ICMP results
# AS info shows traffic crosses three AS boundaries
Explanation:
Demonstrates a systematic troubleshooting approach using multiple traceroute modes to diagnose connectivity issues.
Multiple protocols: UDP failed, ICMP succeeded
Diagnosis: Firewall blocks UDP but allows ICMP/TCP
Numeric mode: Eliminates DNS as variable
AS information: Reveals routing complexities
Bidirectional test: Checks both directions
Systematic approach: Start simple, add complexity
Pro Tip: When troubleshooting, always test multiple protocols. A failure with one protocol doesn't mean the network is down - it may just be filtered.
Additional Information
Essential Options Summary
-I - Use ICMP ECHO for probes (requires root)
-T - Use TCP SYN for probes (requires root)
-U - Use UDP for probes (default, can specify explicitly)
-n - Do not resolve hostnames
-4/-6 - Force IPv4 or IPv6
-p PORT - Set destination port
-q NQUERIES - Set number of queries per hop (default 3)
Meaning: Network congestion or high latency link. Variable response times indicate instability.
Pattern 3: Complete Timeout After Hop
8 router8 30ms
9 * * *
10 * * *
Meaning: Firewall blocking probes, or destination unreachable. Try different protocol (-I or -T).
Combining traceroute with Other Tools
# Get baseline with traceroute
traceroute -n server.com > traceroute_baseline.txt
# Continuous monitoring with mtr
mtr --no-dns --report --report-cycles 100 server.com
# Test specific path segment
ping -c 10 suspicious-router-ip
# Check for packet loss
ping -c 100 -i 0.2 server.com | grep loss
Scripting with traceroute
#!/bin/bash
# Monitor path changes over time
DEST="critical-server.com"
LOGFILE="/var/log/traceroute-monitor.log"
while true; do
echo "=== $(date) ===" >> $LOGFILE
traceroute -n -m 15 -w 2 $DEST >> $LOGFILE 2>&1
sleep 300 # Check every 5 minutes
done
Related Commands
tracepath - Simpler alternative, no root required, includes MTU discovery
mtr - Real-time traceroute with statistics (combines ping and traceroute)
tcptraceroute - TCP-only traceroute alternative
paris-traceroute - Advanced traceroute for load-balanced networks
scamper - Internet measurement tool with traceroute capabilities
ping - Test connectivity and latency to specific hop
Best Practices
Start simple: Begin with default UDP, escalate to ICMP/TCP if needed
Use numeric mode: Add -n when DNS is slow or problematic
Test multiple times: Run traceroute several times to detect route changes
Try all protocols: Different protocols may reveal different paths
Document baseline: Save "normal" traceroutes for comparison
Test both directions: Forward and return paths may differ
Consider time of day: Routing can change based on traffic patterns
Use AS lookups: Understand organizational boundaries with -A
Troubleshooting Decision Tree
Problem: Cannot reach destination Step 1: Run traceroute -n host
→ If complete timeout after hop X: Problem at/after hop X
→ If reaches destination with high latency: Network congestion
Step 2: If UDP fails, try sudo traceroute -I -n host
→ If ICMP succeeds: Firewall blocks UDP
→ If ICMP also fails: Try TCP mode
Step 3: Try sudo traceroute -T -p 80 -n host
→ If TCP succeeds: Firewall blocks UDP/ICMP
→ If all fail: Network/routing issue