How Traceroute Works: TTL Expired, ICMP Hops, and Network Path Diagnostics

When you ping an internet server, you only learn how long the round-trip took. But what happens if packets encounter massive packet loss or take a detour through another continent? That is where Traceroute (tracert on Windows) becomes the most powerful diagnostic tool in an engineer's arsenal.

1. The Genius Trick: Exploiting the Time-To-Live (TTL) Header

The IP packet header contains an 8-bit field called Time-To-Live (TTL). The original purpose of TTL was to prevent lost packets from circulating forever in infinite routing loops. Every time an IP packet crosses an intermediate router (a "hop"), the router decrements the TTL value by 1. When the TTL reaches 0, the router discards the packet and sends back an ICMP Type 11 packet: Time to Live exceeded in transit.

Traceroute turns this safety mechanism into a radar map through an ingenious sequence:

1. Hop 1: Traceroute sends a packet with TTL = 1. Your home Wi-Fi router decrements TTL to 0, drops the packet, and sends back an ICMP TTL Exceeded message. Traceroute records your router's IP and the round-trip time.
2. Hop 2: Traceroute sends a packet with TTL = 2. It passes your home router (TTL becomes 1) and hits your ISP's local gateway router. The gateway decrements TTL to 0 and replies. Traceroute records your ISP gateway.
3. Hop N: Traceroute increments TTL by 1 for each successive probe until the packet reaches the final destination IP, which responds with an ICMP Echo Reply (or TCP/UDP response).

2. Windows (tracert) vs. Linux (traceroute) vs. MTR

• Windows (tracert): By default, Windows sends ICMP Echo Request packets (standard ping packets).
• Linux & macOS (traceroute): By default, Linux sends UDP datagrams to high, random ports (ranging from port 33434 to 33534). It can also be instructed to use ICMP (-I) or TCP SYN (-T).
• MTR (My Traceroute): The industry-standard Linux tool combining the continuous ping history of ping with the multi-hop discovery of traceroute.

3. How to Interpret Traceroute Output Like a Pro

A typical traceroute output displays hop number, three response latency samples, and the reverse DNS hostname:

 1  192.168.1.1 (router.local)       1.2 ms    0.9 ms    1.1 ms
 2  10.240.0.1 (isp-gateway.net)     4.5 ms    4.2 ms    4.8 ms
 3  182.79.141.2 (core-delhi.airtel.in) 12.1 ms  11.8 ms  12.3 ms
 4  * * * Request timed out.
 5  142.250.231.14 (google-peering.net) 14.8 ms  15.1 ms  14.6 ms

4. The Myth of the Asterisk (* * * Request timed out)

A widespread beginner mistake is assuming that seeing asterisks (* * *) on a hop means that the network is broken at that point.

This is usually false. High-throughput enterprise backbone routers prioritize routing customer data packets over their fast ASIC hardware chips. Generating ICMP TTL Exceeded reply packets requires CPU intervention. Many core routers intentionally rate-limit or disable ICMP generation to protect their CPUs.

The golden rule: If subsequent hops (like Hop 5 above) respond normally with low latency, the asterisks on Hop 4 are completely harmless!

5. Spotting Genuine Network Bottlenecks

A real problem exists when:

• Latency suddenly jumps dramatically (e.g. from 15ms to 180ms) and remains high for all subsequent hops.
• Consistent packet loss begins at a specific hop and persists through the final destination.
• Packets bounce back and forth between two identical IP addresses (a routing loop).