linuxlab.io
Tutorials▾
  • Linux & networking
    File system, processes, TCP/IP, BGP and OSPF
    →
  • Terraform & IaC
    HCL, state, plan/apply on a LocalStack sandbox
    →
  • Git & GitHub
    Object model, plumbing, branching, GitHub Actions
    →
All tutorials →
PricingAboutSign inCreate account
/
Intro
Lessons
Footer
linuxlab-TutorialsPricingAboutPrivacy & cookies
Copyright © 2026 LinuxLab. All rights reserved.
linuxlab.io
Tutorials▾
  • Linux & networking
    File system, processes, TCP/IP, BGP and OSPF
    →
  • Terraform & IaC
    HCL, state, plan/apply on a LocalStack sandbox
    →
  • Git & GitHub
    Object model, plumbing, branching, GitHub Actions
    →
All tutorials →
PricingAboutSign inCreate account
/
  • Introduction
  • Lessons
  • How it works
  • Simulator
  • Knowledge base
  • Interview prep
home/linux/how/traceroute

how/network

How traceroute sees the path to a server

No packet comes back with the route inside it. To see the path, traceroute cleverly exploits TTL: it "kills" packets at each hop and collects the ICMP replies.

When a site "loads slowly," where is the bottleneck? On your end? At your ISP? On the backbone? Without visibility into the path this is blind guessing.

traceroute shows you every router on the path to the target server plus the delay at each one. But how? Network packets do not carry a "list of all hops" inside them, and routers are not obligated to reveal them.

The solution is the TTL trick. traceroute deliberately sends packets that will die at a chosen router, then collects their "dying notices" (ICMP time-exceeded). Each notice comes from a specific router, and that is how the list is built.

Press ▶ and watch how 4 packets with increasing TTL produce the full path.

step 1/5·00 · we want to see the path to google.com
youtracerouteROUTERR1home/ISPROUTERR2ISP backboneROUTERR3peeringgoogle.com142.250.46.1$ TRACEROUTE GOOGLE.COMхотим узнать путь до google.com - обычные пакеты не помогут, нужен трюк с ttl

§ steps

  1. Between us and google.com sit several routers (usually 8-15). Which ones exactly we do not know, and ordinary packets do not answer this question.

    The reply from google.com arrives as a "reply from google.com," with no information about the intermediate hops. We need a different approach.

recap

What to remember:

  • The trick is simple: each traceroute probe has its own TTL: 1, 2, 3, 4... At TTL=N the packet dies at the Nth router, which sends ICMP time-exceeded → traceroute learns the router IP and measures RTT
  • Each TTL usually gets 3 probes sent (you see 3 RTT values in the output). This gives you the spread of delay and shows stability
  • Linux traceroute by default sends UDP to an "unusual" high port. Windows tracert uses ICMP echo. macOS uses UDP. If a firewall drops one type, try traceroute -I (ICMP) or -T -p 443 (TCP to an open port)
  • Asterisks * * * at a hop mean the router does not reply. Often this is a security policy: the router forwards traffic but stays silent on ICMP. It does not mean the path is broken
  • mtr = traceroute + ping in one. It continuously pings every hop and shows the % of loss. Indispensable for debugging "it lags sometimes"
  • Asymmetric routing: traceroute shows only the path out. Packets coming back may take a different route. On complex topologies you have to keep this in mind

If you want to go deeper, there is an [[traceroute|extended article]] that covers mtr and tcptraceroute.

§ dig into the knowledge base

  • traceroutetraceroute - extended article
  • icmpICMP - what time-exceeded is
  • routing-tablerouting - how the path is formed
Footer
linuxlab-
Copyright © 2026 LinuxLab. All rights reserved.
Tutorials
Pricing
About
Privacy & cookies