If a website is loading slowly, your connection keeps dropping, or emails are not reaching their destination, a traceroute (or tracert on Windows) is one of the first tools any network administrator or IT professional reaches for. It shows you exactly which path your data takes across the internet, hop by hop, and pinpoints where problems occur.
This guide covers everything you need to know: what traceroute is, how it works, how to run it on Windows, Mac, and Linux, how to read the results, what all the common flags do, and how to troubleshoot the most frequent issues.
What Is Traceroute (tracert)?
Traceroute is a built-in network diagnostic command available on virtually every operating system. It traces the path that data packets take from your device to a destination, such as a website, server, or IP address, and shows you every router (or “hop”) those packets pass through along the way.
For each hop, traceroute reports:
- The hostname or IP address of that router
- The round-trip time (RTT) is measured in milliseconds, which is the time it took a packet to reach that hop and return.
Think of traceroute as a GPS tracker for your internet traffic. Instead of just telling you whether you reached your destination (which ping does), traceroute shows you the entire journey, every road, every intersection, and how long you spent at each one.
This makes it an invaluable tool for diagnosing:
- Slow website loading times
- Network bottlenecks and high latency
- Routing problems and suboptimal paths
- Packet loss at specific network points
- Whether a problem is on your end, your ISP’s end, or the destination server’s network
Traceroute vs. Tracert: What Is the Difference?
The short answer: they are the same tool with different names on different operating systems.
| Name | Operating System | Protocol Used by Default |
| tracert | Windows | ICMP (Internet Control Message Protocol) |
| traceroute | Linux | UDP (User Datagram Protocol) |
| traceroute | macOS | UDP (User Datagram Protocol) |
Both tools accomplish the same goal, mapping the hop-by-hop route from your device to a destination, but they differ slightly in the underlying network packets they send. Windows tracert uses ICMP Echo Requests (similar to the ping command), while Linux and macOS traceroute use UDP packets by default, though this can be changed with flags.
The practical impact is minimal for most troubleshooting scenarios, but it matters when dealing with firewalls: some networks block UDP packets used by Linux/macOS traceroute, while others block ICMP used by Windows tracert. If one fails, you can often switch protocols using command flags (covered below).
How Does Traceroute Work? (TTL and ICMP Explained)
Traceroute uses a clever technique built on a networking concept called Time-to-Live (TTL).
Every IP packet sent across the Internet contains a TTL value, a number that limits how many routers (hops) the packet is allowed to pass through before it is discarded. Each router that handles a packet decrements the TTL by 1. When the TTL reaches zero, the router discards the packet and sends back an ICMP “Time Exceeded” error message to the sender.
Traceroute exploits this mechanism to map each hop, one at a time:
Step 1: Traceroute sends a packet with TTL = 1. The very first router in the path decrements TTL to 0, discards the packet, and sends back a “Time Exceeded” message, revealing the first hop’s IP address and response time.
Step 2: Traceroute sends a packet with TTL = 2. The first router passes it through (TTL drops to 1), the second router decrements it to 0, discards it, and sends back its “Time Exceeded” message, revealing the second hop.
Step 3 onward: This continues, incrementing TTL by 1 each time, until the packet finally reaches the destination, which sends back a “Port Unreachable” or ICMP Echo Reply message, signalling the trace is complete.
By collecting the ICMP “Time Exceeded” responses from each router along the path, traceroute builds a complete, ordered map of every hop between your device and the destination, along with the round-trip time for each one.
When Should You Run a Traceroute?
Traceroute is most useful in these situations:
Website or application loading slowly: A traceroute to the server’s IP address will show you which hop is adding the most latency, whether it is your local network, your ISP, a transit provider, or the destination’s own network.
Connection intermittently dropping: Running traceroutes over time can reveal a specific hop where packet loss is occurring, pointing to a problematic router or link.
Cannot reach a website or server at all: Traceroute can show you exactly where in the path connectivity breaks down; the last successful hop before the trace stops is usually where the problem lies.
Emails being rejected or flagged: Network routing issues between your mail server and the recipient’s server can sometimes be diagnosed with a traceroute to the destination mail server’s IP.
ISP troubleshooting: Your ISP’s support team will often ask you to run a traceroute to their servers to help diagnose problems on their end.
Security investigations: Network and security professionals use traceroutes as part of reconnaissance and network mapping to understand the infrastructure between two points.
Related read: Reverse IP Address Lookup
How to Run Traceroute on Windows (tracert)
On Windows, the command is called tracert (not traceroute). It is built into every version of Windows, no installation required.
Method 1: Using Command Prompt
Step 1: Press Windows Key + R on your keyboard to open the Run dialog box.
Step 2: Type cmd and press Enter. The Command Prompt window will open.
Step 3: In the Command Prompt, type the tracert command followed by the domain name or IP address you want to trace:
tracert example.com
or using an IP address:
tracert 8.8.8.8
Step 4: Press Enter. The trace will begin immediately and output results line by line.
Step 5: Wait for the trace to complete. You will see a Trace complete. message when it finishes. It may take between 30 seconds and a few minutes, depending on the number of hops involved.
Method 2: Using Windows Search
Step 1: Click the Start button and type cmd in the search bar.
Step 2: Right-click on “Command Prompt” and select “Run as administrator” for full access.
Step 3: Type your tracert command and press Enter.
Sample Windows tracert Output
Tracing route to example.com [93.184.216.34]
over a maximum of 30 hops:
1 2 ms 1 ms 1 ms 192.168.1.1
2 12 ms 10 ms 11 ms 10.20.30.1
3 15 ms 14 ms 15 ms isp-gateway.net [96.120.40.245]
4 22 ms 20 ms 21 ms core-router.isp.net [96.110.175.85]
5 35 ms 34 ms 35 ms 93.184.216.34
Trace complete.
Pro tip: Run tracert 8.8.8.8 to check your path to Google’s DNS server; it is a reliable, always-online destination for testing your network path. See our guide to 8.8.8.8 for more.
How to Run Traceroute on macOS
On macOS, the command is traceroute, and it runs from the Terminal application.
Method 1: Using Terminal
Step 1: Open Terminal. The fastest way is to press Command + Space to open Spotlight, type Terminal, and press Enter.
Step 2: In the Terminal window, type:
traceroute example.com
or using an IP address:
traceroute 8.8.8.8
Step 3: Press Enter. Hops will appear one by one as the trace progresses.
Method 2: Using Network Utility (macOS Monterey and earlier)
On older versions of macOS:
Step 1: Open Applications > Utilities > Network Utility.
Step 2: Click the Traceroute tab.
Step 3: Enter the domain name or IP address in the text field.
Step 4: Click the Trace button.
Note: Network Utility was removed in macOS Monterey (12.x). Use the Terminal method instead.
macOS Traceroute Note on sudo
On some macOS configurations, traceroute may need administrator privileges to use certain protocols:
sudo traceroute example.com
Enter your Mac password when prompted.
How to Run Traceroute on Linux {#traceroute-linux}
On Linux, the command is traceroute. It may or may not be pre-installed depending on your distribution.
Step 1: Check if traceroute is installed
Open a terminal and type:
traceroute –version
If you see a version number, it is already installed. If you see “command not found,” proceed to Step 2.
Step 2: Install traceroute (if not installed)
Ubuntu / Debian:
sudo apt-get install traceroute
CentOS / RHEL / Fedora:
sudo yum install traceroute
Arch Linux:
sudo pacman -S traceroute
Step 3: Run the traceroute command
traceroute example.com
or:
traceroute 8.8.8.8
On some Linux distributions, raw socket operations may require root privileges:
sudo traceroute example.com
Linux ICMP mode (same as Windows tracert)
By default, Linux traceroute uses UDP. To switch to ICMP mode (matching Windows tracert behaviour):
sudo traceroute -I example.com
How to Run Traceroute on Android and iOS
Mobile devices do not have a built-in terminal for traceroute by default, but free apps make it easy.
Android
Install a free network utility app from the Google Play Store, such as “Network Analyzer” or “Ping & Net”. These apps include a traceroute function; simply enter the domain or IP address and tap the traceroute button.
iOS (iPhone / iPad)
Install a free app from the App Store, such as “Network Analyzer” or “HE.NET Network Tools”. Both include a visual traceroute function that maps hops on a world map alongside the traditional output.
Traceroute Command Flags and Options Explained
Both tracert (Windows) and traceroute (Linux/macOS) support additional flags that modify how the command runs.
Windows tracert Flags
| Flag | Description | Example |
| -d | Skips DNS resolution, shows IP addresses only, which speeds up the trace | tracert -d example.com |
| -h <MaxHops> | Sets the maximum number of hops (default: 30) | tracert -h 50 example.com |
| -w <timeout> | Sets the wait time in milliseconds before a hop times out (default: 4000ms) | tracert -w 1000 example.com |
| -4 | Forces IPv4 | tracert -4 example.com |
| -6 | Forces IPv6 | tracert -6 example.com |
Full Windows tracert syntax:
tracert [-d] [-h MaximumHops] [-w timeout] [-4] [-6] target
Linux/macOS traceroute Flags
| Flag | Description | Example |
| -n | No DNS resolution, shows IPs only, faster trace | traceroute -n example.com |
| -m <hops> | Sets the maximum number of hops (default: 30) | traceroute -m 50 example.com |
| -w <seconds> | Wait time before timeout at each hop | traceroute -w 5 example.com |
| -I | Uses ICMP instead of UDP (same as Windows tracert) | sudo traceroute -I example.com |
| -T | Uses TCP SYN packets, useful for bypassing firewalls | sudo traceroute -T example.com |
| -p <port> | Specifies destination port | traceroute -p 80 example.com |
| -q <queries> | Number of probes per hop (default: 3) | traceroute -q 5 example.com |
| -4 / -6 | Force IPv4 or IPv6 | traceroute -4 example.com |
How to Read Traceroute Output
Once the trace completes, you will see output that can look overwhelming at first glance. Here is how to interpret every part of it.
Sample Output
Tracing route to hashetools.com [104.21.30.125]
over a maximum of 30 hops:
1 2 ms 1 ms 2 ms 192.168.1.1
2 10 ms 9 ms 11 ms 10.20.0.1
3 15 ms 14 ms 15 ms isp-gateway.example.com [96.120.40.245]
4 22 ms 21 ms 23 ms core1.isp.net [96.110.175.85]
5 45 ms 44 ms 47 ms ae-3.r21.nycmny01.us.bb.gin.ntt.net [129.250.6.97]
6 * * * Request timed out.
7 55 ms 54 ms 56 ms 104.21.30.125
Trace complete.
Column-by-Column Breakdown
Column 1 – Hop Number: The sequential number of each router in the path. Hop 1 is almost always your local router (gateway). The final hop is the destination server.
Columns 2, 3, 4 – Response Times (ms): Three separate round-trip time measurements in milliseconds. Traceroute sends three packets to each hop for reliability. These three values tell you:
- If all three are similar, that hop’s latency is stable
- If values vary wildly, there may be congestion or instability at that hop
- Lower is better; under 100ms is generally good, over 200ms is high
Column 5 – Hostname / IP Address: The domain name (if DNS resolved it) and/or the IP address of the router at that hop.
What Different Latency Values Mean
| Response Time | Interpretation |
| 1–20 ms | Excellent, local network or very nearby |
| 20–100 ms | Normal for domestic routing |
| 100–200 ms | Acceptable for international routes |
| 200–400 ms | High latency, investigate this hop |
| 400ms+ | Very high, likely a problem or geographic distance |
Identifying a Problem Hop
The key to reading traceroute output for troubleshooting is watching for a sudden jump in latency. If hops 1–5 show 20ms and hop 6 suddenly shows 200ms, and stays high for all subsequent hops, hop 6 is where the problem is occurring.
If latency is high at one hop but drops back to normal at the next hop, that particular router simply de-prioritises ICMP responses, and the delay is not a real problem.
What Do Asterisks (* * *) Mean in Traceroute?
You will often see rows of three asterisks in traceroute output:
6 * * * Request timed out.
Asterisks mean that no response was received from that hop within the timeout period. This does not always indicate a problem. Here is what different asterisk patterns mean:
Asterisks at one hop, then normal results resume: The router at that hop is configured to not respond to ICMP or UDP probe packets (firewalls and security-hardened routers commonly do this). The path is still working normally, the router is just silent.
Asterisks at every hop from a certain point onwards: This is the serious case. It usually means:
- The path is broken at or after the last successful hop
- A firewall is blocking all further responses
- The destination server or network is unreachable
Asterisks only at the last hop: The destination server itself may be blocking ICMP responses while still serving traffic normally on other ports (HTTP/HTTPS). Try accessing the website. If it loads, the asterisks are just firewall-filtered probes, not a real issue.
What to check based on where asterisks appear:
- Hops 1-3: The problem is likely on your local network or with your router
- Hops 4-8: Your ISP’s network may be having issues
- Hops 9 onward: The problem is either with a transit provider or with the destination’s network
- Final hop only: The destination server is likely filtering ICMP
Traceroute vs. Ping: What Is the Difference?
Ping and traceroute are both network diagnostic tools, and they complement each other well.
| Feature | Ping | Traceroute |
| What it tests | Whether the destination is reachable | The full path to the destination, hop by hop |
| Information returned | Round-trip time, packet loss | Each router in the path has per-hop latency |
| Identifies bottleneck location | No | Yes |
| Typical use case | Quick connectivity check | Diagnosing where exactly a problem occurs |
| Speed | Very fast | Slower (traces every hop) |
When to use ping: When you want to quickly check if a server is online and measure basic latency.
When to use traceroute: When you know there is a problem, and you need to identify exactly where in the network path it is happening.
Related read: Website IP Lookup
Common Traceroute Problems and What They Mean
Problem 1: Trace stops at hop 1 (your local router)
What it means: Your device cannot reach even the first hop, your own gateway/router. The problem is on your local network.
What to check: Reboot your router, check your network cable or Wi-Fi connection, and verify your local IP configuration.
Problem 2: Trace stops after a few hops at your ISP
What it means: Your traffic is reaching your ISP but not going any further. This is typically an ISP-side routing issue.
What to do: Contact your ISP with the traceroute output as evidence. The output clearly shows where the path breaks.
Problem 3: Extremely high latency at a specific hop
What it means: A router in the path is overloaded, geographically distant, or de-prioritizing probe packets.
What to check: If latency remains high at all subsequent hops, too, that hop is genuinely problematic. If subsequent hops are normal, the router is simply deprioritising ICMP, and it is not a real problem.
Problem 4: Destination unreachable / trace never completes
What it means: The destination is offline, has a firewall blocking the protocol, or the route does not exist.
What to check: Try the trace with a different protocol (use -I flag on Linux to switch to ICMP, or -T for TCP). Also, check if the destination website loads in a browser; if it does, the server just filters ICMP probes.
Problem 5: “Destination net unreachable” at hop 1
What it means: Your default gateway (router) has no route to the destination network.
What to check: This often indicates a routing table issue. Check your router’s configuration or contact your ISP.
Problem 6: Trace works from your device but not from the destination
What it means: The path may be asymmetric; internet traffic does not always take the same route in both directions. Issues may only appear in one direction.
What to do: Run a traceroute from the destination server back to your IP (this is what a reverse traceroute does). Some online tools offer this capability.
Related read: Reverse IP Address Lookup
How to Save Traceroute Results to a File
When troubleshooting network issues, especially when sharing results with your ISP, hosting provider, or IT team, you will want to save the output to a text file.
Windows: Save the tracert to a File
tracert example.com > C:\tracert-results.txt
This saves the results to a file called tracert-results.txt on the C: drive. You can open this file in Notepad or any text editor.
To save AND see the results in real time at the same time:
tracert example.com | tee C:\tracert-results.txt
macOS / Linux: Save traceroute to a File
traceroute example.com > traceroute-results.txt
The file will be saved in whichever directory your terminal is currently in. To see where that is, type pwd before running the command.
Sharing Traceroute Results
When sending results to your ISP or support team, include:
- The tracert/traceroute output (full text)
- Your public IP address
- The destination you traced to
- The date and time the trace was run
- A brief description of the problem you are experiencing
You can quickly check your public IP using the HasheTools My IP Address Tool and get detailed information about any IP using the HasheTools IP Lookup Tool.
Frequently Asked Questions
Is traceroute the same as tracert?
Yes, they are the same diagnostic tool. Tracert is the name Microsoft uses on Windows, while traceroute is the name used on Linux and macOS. Both map the hop-by-hop path your data takes to a destination.
How many hops is normal for a traceroute?
A typical domestic traceroute to a nearby server shows between 5 and 15 hops. International routes can show 20–30 hops. If you reach the default maximum of 30 hops without arriving at the destination, it usually means the destination is unreachable or heavily firewalled.
Why does my traceroute show asterisks (* * *)?
Asterisks mean a particular hop did not respond within the timeout period. This is often caused by firewalls or routers that are configured not to respond to ICMP/UDP probe packets. If subsequent hops respond normally, the asterisks are generally not a problem.
Can traceroute damage or harm a network?
No. Traceroute sends very small, standard network packets and does not harm networks in any way. It is a completely safe, read-only diagnostic tool.
Why does traceroute show different results each time I run it?
Internet routing is dynamic. Routers constantly adjust paths based on traffic load, network conditions, and routing table updates. Running a traceroute twice in quick succession may show slightly different paths; this is normal. For accurate troubleshooting, run multiple traces and look for consistent patterns.
What does “Request timed out” mean at every hop?
If every single hop after a certain point shows “Request timed out,” the path is broken at that point. The last responsive hop is where the problem likely originates. If all hops from the very beginning time out, you may have a local network or firewall issue blocking the tool entirely.
Can I run a traceroute on a domain name or only an IP address?
Both work. You can use either a domain name (e.g., tracert example.com) or an IP address (e.g., tracert 8.8.8.8). When you use a domain name, traceroute automatically resolves it to an IP address first.
What is a visual traceroute?
A visual traceroute is a graphical representation of the standard traceroute output, often showing hops plotted on a world map with geographic locations derived from IP geolocation data. It makes it easier to visualise the physical routing path your data takes across the internet.
Why does the latency suddenly drop in the middle of my traceroute?
Some routers prioritise traffic forwarding over generating ICMP responses. This means a router might appear to have high latency in a traceroute output even though it is actually forwarding traffic efficiently. If latency drops back down at subsequent hops, the apparent spike at that hop is not a real problem; it is just a router that responds to probe packets slowly while processing real traffic quickly.
Conclusion
The traceroute (or tracert on Windows) command is one of the most powerful and practical tools in any network troubleshooter’s toolkit. Whether you are investigating a slow website, hunting down packet loss, diagnosing email delivery issues, or simply curious about how your data travels across the internet, traceroute gives you a clear, hop-by-hop map of the path your data takes.
The key things to remember:
- Windows uses tracert, Linux and macOS use traceroute
- Each line of output = one router (hop) in the path
- The three numbers per hop are round-trip times in milliseconds
- Asterisks mean a hop did not respond, which is not always a problem
- A sudden spike in latency that stays high across subsequent hops = real issue
- Save your output to a file when sharing with support teams
Ready to go deeper? Use the HasheTools DNS Lookup Tool to check DNS records for any domain you are tracing, or use the HasheTools IP Lookup Tool to get detailed information about any IP address that appears in your traceroute output.
