What is a Traceroute? How Does a Traceroute Work?

What Is a Traceroute?

Introduction

Traceroute is a network diagnostic tool (which runs over Layer 3) used to diagnose the path taken by a network packet to reach a destination IP. Traceroute shows the latency and packet loss between a source and destination network point, as well as any network hops in between.

What is a traceroute used for?

Traceroutes are invaluable when debugging network issues. They allow us to diagnose suboptimal network routes, loops, or packet loss while connecting between two points in a network. They can also be used to troubleshoot network failures and failed routes.

To get an accurate representation of a traceroute result, it's best practice to run a traceroute in both directions: from destination to source and back again.

How does a traceroute work?

A traceroute usually relies on internet control message protocol (ICMP) messages to send echo packages. The traceroute measures the response time between the time when it sent the message and the time it received a reply, which is called latency. This is calculated for each network hop to give as much visibility as possible into the network route. It's also possible to run a traceroute in TCP mode for situations where ICMP is unavailable, but this is less common.

What does packet loss in a traceroute mean?

Packet loss in a traceroute means that a specific hop or destination address failed or refused to send a response message. This can indicate network congestion or other issues.

Due to the nature of ICMP, some hops between the source and destination might refuse to send a reply message. It's not uncommon to see hops in the middle report packet loss by routers that are set to deprioritize or ignore ICMP packets. Because of this, we usually focus on the packet loss on the last hop of the route (the destination) to get a more accurate understanding of any potential issues.