How traceroute Works - Visualizing a Packet's Journey with the TTL Trick

traceroute - Mapping a Packet's Journey

If ping checks "whether it reaches the destination," traceroute visualizes "which path it takes to get there." When you access IP Check-san, your packets travel through dozens of network devices - from your home router through your ISP, IX (Internet Exchange Point), undersea cables, and data centers. traceroute displays the IP address and latency of each hop (relay point) along that route.

The TTL Trick - An Ingenious Mechanism

traceroute works by cleverly exploiting the TTL (Time To Live) field in IP packets.

TTL is a counter that decrements by 1 each time a packet passes through a router. When TTL reaches 0, that router discards the packet and sends an ICMP Time Exceeded message back to the sender. This mechanism was designed to prevent packets from looping endlessly on the network.

traceroute turns this mechanism on its head:

1. Send a packet with TTL=1 → TTL reaches 0 at the first router, which returns ICMP Time Exceeded → The 1st hop's IP address and latency are revealed
2. Send a packet with TTL=2 → TTL reaches 0 at the second router → The 2nd hop is revealed
3. Incrementally increase TTL to 3, 4, 5... repeating until the destination is reached

This simple idea of "incrementing TTL by 1" is what makes network route visualization possible.

traceroute vs tracert - Unix and Windows Differences

On Unix/Linux/macOS the command is traceroute, while on Windows it's tracert. Beyond the name, the default behavior also differs.

• Unix traceroute: Uses UDP packets by default. Sends to destination ports starting from 33434, incrementing each time. When the destination is reached, ICMP Port Unreachable is returned
• Windows tracert: Uses ICMP Echo Request by default. Since it uses the same protocol as ping, it's more susceptible to firewalls that block ICMP

The traceroute widely used on Linux (Dmitry Butskoy's version) can switch to ICMP mode with the -I option or TCP mode with -T. BSD-derived traceroute, such as the one on macOS, has no -T; you specify the protocol instead, as in -P tcp (-I is an alias for -P icmp). In environments where firewalls block UDP or ICMP, TCP mode (ports 80 or 443) is effective.

Reading traceroute Output

Typical traceroute output looks like this:

• Hop 1: Your home router. Latency is about 1 ms - local network communication
• Hops 2-3: Routers within your ISP's network. Latency gradually increases
• Hop 4 "* * *": No response came back from this hop. Most often the router is configured not to return ICMP Time Exceeded - a deliberate firewall configuration that many administrators apply to hide internal infrastructure - but ICMP rate limiting or a filter on the return path can produce the same result. If later hops are still displayed, the packets themselves are getting through
• Hop 5: Latency jumps dramatically (12 ms → 85 ms). This likely indicates crossing an undersea cable
• Hop 6: The destination server

Three measurements are taken at each hop because network latency fluctuates, and multiple measurements improve reliability.

The "Geography of the Internet" Visible Through traceroute

traceroute results can reveal the physical path of packets.

• Sudden latency spikes: Hops crossing intercontinental undersea cables show latency increases of tens of milliseconds. Light in optical fibre travels at roughly 200,000 km/s (about two-thirds of the speed of light in a vacuum), so every 1,000 km of one-way distance adds about 5 ms - about 10 ms in the round-trip time (RTT) that traceroute displays. Submarine cables detour considerably from the great-circle distance, so measured values always exceed that floor
• City names in hostnames: Many ISPs and carriers include city names or airport codes in router hostnames. Abbreviations like nrt / hnd (Tokyo), lax (Los Angeles), and ams (Amsterdam) let you infer the geographic path of packets. Naming conventions are each operator's own habit, though, and an old place name can linger after equipment is relocated, so treat them as hints
• AS numbers: Linux traceroute uses -A, while BSD-derived versions such as macOS use -a, to display the AS (Autonomous System) number for each hop. AS numbers reveal which organization's network the packets are traversing

Limitations and Caveats of traceroute

• Asymmetric routes: Outbound and return packets may take different paths. traceroute only shows the outbound route
• MPLS tunnels: When ISPs use MPLS (Multi-Protocol Label Switching), hops within the tunnel may be invisible
• Load balancers: Running traceroute to the same destination multiple times may show different routes, as load balancers distribute packets across different paths
• Rate limiting: When routers rate-limit ICMP Time Exceeded responses, displayed latency may appear higher than actual

Summary

traceroute is an excellent tool that uses the simple TTL mechanism to visualize packet routes. Try running traceroute to the IP address you see on IP Check-san - you'll see which ISPs, cities, and undersea cables your packets traverse. The experience of seeing the Internet's "map" with your own eyes will deepen your understanding of networking.

Frequently Asked Questions

How does traceroute discover the network path?

Traceroute sends packets with incrementally increasing TTL (Time to Live) values starting from 1. Each router along the path decrements the TTL, and when it reaches 0, the router sends back an ICMP Time Exceeded message, revealing its identity. By increasing the TTL one hop at a time, traceroute maps each router in the path.

Does '* * *' in traceroute output indicate a problem?

Not necessarily. Asterisks mean the router at that hop did not respond within the timeout period. Many routers are configured to drop or deprioritize ICMP packets for security or performance reasons. If subsequent hops respond normally, the network path is likely fine.

What is the difference between traceroute and tracert?

traceroute is the Unix/Linux/macOS command that uses UDP packets by default, while tracert is the Windows command that uses ICMP Echo Request packets. Both achieve the same goal of mapping network paths but use different protocols, which can produce slightly different results when firewalls treat UDP and ICMP differently.