traceroute

traceroute sends probes with increasing IPv4 TTL or IPv6 Hop Limit values. Routers where the value expires can return Time Exceeded messages, revealing some responding points along the forward path.

How Hop Discovery Works

Probes begin with a hop limit of one and increase. The first router decrements one to zero and can return an ICMP error. A limit of two reaches the second router before expiring, and the process continues until the destination responds or the maximum is reached.

CheckWhich field causes successive probes to expire at later routers?

The DNS cache TTL for the destination name. The Ethernet source MAC address. IPv4 TTL or IPv6 Hop Limit.

Probe Methods

Traditional Linux traceroute commonly sends UDP probes to high destination ports. The destination can signal completion with ICMP Port Unreachable. Options can instead use ICMP Echo or TCP SYN probes, which can traverse filtering differently:

$ traceroute -n example.com
$ traceroute -I -n example.com
$ traceroute -T -p 443 -n example.com

Privileges and supported options vary. Use methods authorized for the target, and record the method when comparing results.

CheckWhat commonly ends a traditional Linux UDP traceroute?

An ICMP Port Unreachable response from the destination. A mandatory HTTP 200 response from every router. An Ethernet broadcast from the destination across the Internet.

Interpreting Asterisks

An asterisk means no response was observed for that probe before timeout. The router may forward transit traffic while filtering or rate-limiting diagnostic responses. If later hops answer, the silent hop clearly forwarded at least some probes.

CheckWhat does * at one hop prove?

That the router dropped all transit packets permanently. Only that no matching response arrived before the probe timeout. That the destination has no IP address.

Timing and Path Variation

Per-hop times measure round trips to control responses, not latency added by the link between adjacent printed lines. Routers can deprioritize control-plane replies. Load balancing can send probes through different paths, and name resolution can add display delay; -n avoids reverse lookups.

The return route for each ICMP response can differ from the forward route. Repeat tests and correlate with endpoint application timing before identifying a bottleneck.

CheckWhy should adjacent hop RTT values not be subtracted as exact link latency?

Traceroute reports all times in bytes rather than milliseconds. Replies can use different return paths and control-plane processing. Every router has the same clock as the source.

Comparing with the Application

A traceroute can reach the destination while the service is blocked, and the service can work while intermediate routers hide their responses. Test the same address family, destination, transport protocol, and port as the application, then use traceroute as supporting path evidence.

CheckDoes a completed traceroute prove an HTTPS service is healthy?

Yes, because every hop validates the server certificate. No; transport, TLS, and HTTP behavior need their own tests. Yes, but only if reverse DNS names are printed.

Summary

You can now interpret traceroute as a series of bounded-hop probes, not a complete path oracle.

1. Explain hop discovery through TTL or Hop Limit expiration.
2. Record whether UDP, ICMP, or TCP probes were used.
3. Treat asterisks as missing responses rather than proven outages.
4. Avoid deriving exact link latency from adjacent hop RTTs.
5. Correlate path evidence with the real application.