Traceroute

traceroute (tracert on Windows) maps the routers between you and a destination. It exploits the IP TTL field: probe 1 is sent with TTL 1, the first router decrements it to 0 and replies with ICMP Time Exceeded, exposing its IP address. Probe 2 is sent with TTL 2, the second router replies, and so on, until a probe finally reaches the destination, which answers in a different way that ends the trace.

The probes themselves are not standardized. Classic Unix traceroute sends UDP datagrams to high, unlikely ports and treats ICMP Port Unreachable from the destination as the end marker. tracert on Windows sends ICMP Echo Requests directly. Modern variants (tcptraceroute, traceroute -T) use TCP SYN to a real port like 80 or 443, which is far more likely to traverse firewalls that drop UDP and untargeted ICMP.

Latency in the output is per-hop response time, not the time a packet spent at that router. A high latency on hop 3 with low latency on hop 4 usually means hop 3's control plane is slow to answer, not that traffic was actually delayed there. Likewise, asterisks (* * *) mean a router did not reply to the probe — usually because of ICMP rate limiting — and do not necessarily indicate packet loss for real traffic.

Internet paths are often asymmetric: the return path from each router may not match the forward path you are probing, so the round-trip time reflects both directions. traceroute therefore complements ping for diagnosing where a session is failing, but reading it correctly requires treating per-hop numbers as hints rather than precise measurements.