Traceroute

How does traceroute work?

Traceroute sends packets whose Time To Live (hop limit in IPv6) starts at 1 and grows by one; each router that drops a packet because the counter reached zero answers with an ICMP time-exceeded message (RFC 792, RFC 4443), which reveals one hop of the path. Routers may rate-limit those answers (RFC 1812), so a silent or slow hop matters only when the silence or delay continues to the hops after it.

How to use Traceroute

1. Enter a host name or IP address, choose a probe region or type up to five locations, and set how many probes to use.
2. Keep ICMP, or choose TCP with the service port (443 for a website) when ICMP is filtered on the way.
3. Press Run traceroute; the probes report within a few seconds. Read Paths by probe first, then the hop table and the findings.
4. To read a trace from your own machine, run tracert or traceroute, paste the whole output into the box and press Analyze pasted output.

Traceroute features

• Traceroute from up to 10 Globalping probes at once, each probe a separate path from its own country or network to the host
• ICMP, UDP or TCP probes, so a path that stops at a firewall dropping ICMP can be traced again on the service port
• Every hop with its reverse-DNS name, address, individual round trips and average, grouped by probe, with the silent hops marked; pasted output that records each unanswered probe also gives every hop’s loss
• Path reading per probe: target reached or not, the largest latency jump, loss that is only ICMP rate limiting, private and carrier-grade NAT hops
• A paste box for tracert, traceroute or mtr --report output from your own computer, analyzed in the browser with the same engine
• Hop tables as CSV and every probe’s raw output as text

Inputs and outputs

Inputs

• Host name or IP address (public targets only), probe region or up to five locations, number of probes (1–10), protocol (ICMP, UDP, TCP) and the port for UDP or TCP.
• Or pasted text: the full output of tracert, traceroute or traceroute6, or mtr --report, as printed on your computer.

Outputs

• Summary: probes that reached the target, hops per path, paths traced and the target address (paste mode: format, hops, target reached, last answering hop, highest average).
• Paths by probe (location, network, hops, target reached, last hop that answered, final average) and the hop table with names, addresses, round trips and averages; its Loss column shows 100% for a silent hop and, for pasted output, the share of unanswered probes.
• Findings per probe, the Globalping measurement record and the raw output of every probe.

Traceroute example

Tracing route to one.one.one.one [1.1.1.1]
over a maximum of 30 hops:
  1    <1 ms    <1 ms    <1 ms  192.168.1.1
  2     4 ms     3 ms     4 ms  100.64.0.1
  3     *        *        *     Request timed out.
  4     9 ms     8 ms     9 ms  172.71.52.3
  5    11 ms    10 ms    11 ms  one.one.one.one [1.1.1.1]

Detected format: tracert · Hops: 5 (max 30) · Target reached: yes (1.1.1.1) · Last hop that answered: 5 · Highest average: 10.7 ms (hop 5)
Findings:
- The target answered at hop 5 (average 11 ms).
- Hops 1, 2 use private or carrier-grade NAT addresses: your router and the ISP’s access network before the public Internet.
- Loss at hop 3 does not continue to later hops: those routers rate-limit their ICMP replies; it is not real packet loss.
- Hop 3 never answers (it forwards traffic but does not send TTL-exceeded messages); harmless when later hops respond.

How to read the Traceroute results

Target reached = yes means the last hop answered from the target’s own address. No means the last hops stayed silent: often a firewall at the destination that drops probes, which is not an outage if the service works.

Read latency from left to right: a jump that persists into every later hop (for example +60 ms between two hops in different countries) is a long-distance link; a single slow hop followed by faster ones is a router answering slowly.

Loss at an intermediate hop that does not continue to later hops is ICMP rate limiting. Loss that starts at one hop and continues to the destination is real.

The first hops in 10.x, 172.16–31.x, 192.168.x or 100.64.x are private or carrier-grade NAT networks before the public Internet; they are normal.

When to use Traceroute

• Finding where a path from the Gulf or Europe to a server detours through another continent and adds latency.
• Showing a hosting provider or ISP which hop starts the loss or delay, with the measurement ID as evidence.
• Checking that traffic from several regions reaches a CDN’s nearby edge rather than a distant origin.
• Reading a tracert a customer sent you, without having to interpret Windows and Unix formats by hand.

Troubleshooting

• The trace ends in asterisks before the target: the destination or a firewall drops the probe type. Run it again with TCP on the port the service uses.
• Every hop after the first few is silent from one probe only: that probe’s network filters outgoing traceroute traffic; compare with another region.
• "This text does not look like tracert, traceroute or mtr output": paste the complete output including the hop lines, not a screenshot transcription or a summary.
• A quota or measurement-limit message: Globalping and this site limit measurements per hour; wait for the reset time shown or use fewer probes.

Frequently asked questions about Traceroute

Technical notes

Traceroute sends probes with an increasing IP Time To Live (IPv6 hop limit). A router that decrements it to zero returns ICMP Time Exceeded (RFC 792 for IPv4, RFC 4443 for IPv6); the destination answers with an echo reply (ICMP), a port-unreachable message (UDP) or a SYN-ACK or reset (TCP).

Routers generate those ICMP messages in software and may rate-limit them (RFC 1812 §4.3.2.8), so a hop can show loss or a high round trip without affecting traffic that passes through it. The engine treats loss that disappears at a later hop as rate limiting, not as packet loss.

Probe mode: the Mutqan server validates the host and asks Globalping to run the trace (the poll waits up to 20 seconds). Paste mode: the text is parsed in the browser; the format (Windows tracert, Unix traceroute, mtr --report) is detected from the text.

Limitations and methodology

Probe mode measures from Globalping community probes in the chosen locations, never from your computer; the path from your own network can differ completely. Use paste mode for your own path.

Traceroute shows the forward path only. The return path, which can be different, is invisible, and routers that do not answer probes appear as asterisks.

Load-balanced networks can send successive probes along different paths, so one hop may show addresses from several routers.

A probe trace lists the replies each hop sent, not how many probes it was sent, so the Loss column shows — for a hop that answered and 100% only for a hop that stayed silent. Use the MTR Network Diagnostic for loss per hop.

At most 10 probes per measurement, 30 measurements per visitor per hour and Globalping’s hourly quota.

Security and privacy

Probe mode sends the host and the options from the Mutqan server to Globalping, where the parameters and results are public to anyone with the measurement ID. Mutqan stores nothing.

Paste mode is processed entirely in your browser: the trace, which can reveal your private addresses and your ISP, is not uploaded.

References

• RFC 792: Internet Control Message ProtocolIETFDefines ICMP for IPv4, including the echo request and echo reply that ping uses and the time-exceeded message that traceroute relies on.
• RFC 4443: Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) SpecificationIETF · 2006The IPv6 version of ICMP: echo request and reply, time exceeded and destination unreachable messages, and the rate limiting routers apply to them.
• RFC 1812: Requirements for IP Version 4 RoutersIETF · 1995What routers must do, including when they send ICMP time-exceeded and unreachable messages and that they may rate-limit them — why a hop can look lossy in a traceroute while forwarding normally.