traceroute sends probes with increasing IPv4 TTL or IPv6 Hop Limit values. Routers where the value expires can return Time Exceeded messages, revealing some responding points along the forward path.
Troubleshooting · Lesson 3
traceroute
Learn how traceroute discovers responding hops and how to interpret gaps, timing, and path variation.
How Hop Discovery Works
Probes begin with a hop limit of one and increase. The first router decrements one to zero and can return an ICMP error. A limit of two reaches the second router before expiring, and the process continues until the destination responds or the maximum is reached.
Which field causes successive probes to expire at later routers?
Probe Methods
Traditional Linux traceroute commonly sends UDP probes to high destination ports. The destination can signal completion with ICMP Port Unreachable. Options can instead use ICMP Echo or TCP SYN probes, which can traverse filtering differently:
$ traceroute -n example.com
$ traceroute -I -n example.com
$ traceroute -T -p 443 -n example.com
Privileges and supported options vary. Use methods authorized for the target, and record the method when comparing results.
What commonly ends a traditional Linux UDP traceroute?
Interpreting Asterisks
An asterisk means no response was observed for that probe before timeout. The router may forward transit traffic while filtering or rate-limiting diagnostic responses. If later hops answer, the silent hop clearly forwarded at least some probes.
What does * at one hop prove?
Timing and Path Variation
Per-hop times measure round trips to control responses, not latency added by the link between adjacent printed lines. Routers can deprioritize control-plane replies. Load balancing can send probes through different paths, and name resolution can add display delay; -n avoids reverse lookups.
The return route for each ICMP response can differ from the forward route. Repeat tests and correlate with endpoint application timing before identifying a bottleneck.
Why should adjacent hop RTT values not be subtracted as exact link latency?
Comparing with the Application
A traceroute can reach the destination while the service is blocked, and the service can work while intermediate routers hide their responses. Test the same address family, destination, transport protocol, and port as the application, then use traceroute as supporting path evidence.
Does a completed traceroute prove an HTTPS service is healthy?
Lesson complete
You finished traceroute
You can now interpret traceroute as a series of bounded-hop probes, not a complete path oracle.
Explain hop discovery through TTL or Hop Limit expiration.
Record whether UDP, ICMP, or TCP probes were used.
Treat asterisks as missing responses rather than proven outages.
Avoid deriving exact link latency from adjacent hop RTTs.
Correlate path evidence with the real application.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account