1. Tool Introduction
traceroute is a classic network diagnostic utility used to discover and display the path (sequence of routers/hops) that packets take from a source host to a destination host across an IP network. It works by sending probe packets with progressively increasing Time-To-Live (TTL) values (starting at 1) and recording the ICMP “Time Exceeded” replies sent back by each intermediate router as the TTL expires at each hop, until the destination is finally reached. This reveals the network topology between source and destination and can help identify routing issues, latency bottlenecks, and points where traffic is being dropped or filtered. On Linux, traceroute defaults to UDP probes, but supports ICMP and TCP modes as well.
2. Installation
sudo apt update
sudo apt install traceroute -y
Verify:
traceroute --version
Expected output:
Modern traceroute for Linux, version 2.1.6
3. Syntax
traceroute [OPTIONS] <destination> [packet size]
4. Command-Line Options (Full Reference)
-4— Force IPv4-6— Force IPv6-I, --icmp— Use ICMP ECHO for probes-T, --tcp— Use TCP SYN for probes-U, --udp— Use UDP for probes (default)-UL— Use UDP Lite for probes-D, --dccp— Use DCCP Request for probes-p, --port=<port>— Set destination port (base port for UDP, fixed for TCP)-s, --source=<address>— Set source address-i, --interface=<name>— Specify network interface-f, --first=<ttl>— Set initial TTL (starting hop)-m, --max-hops=<max_ttl>— Set maximum number of hops (default 30)-q, --queries=<nqueries>— Number of probe packets per hop (default 3)-N, --sim-queries=<n>— Number of simultaneous probes-w, --wait=<seconds>— Time to wait for a response-z, --sendwait=<time>— Minimum time interval between probes-g, --gateway=<gate>— Loose source route via specified gateway(s)-t, --tos=<num>— Set Type of Service-l, --flowlabel=<num>— Set IPv6 flow label-F, --dont-fragment— Set “don’t fragment” bit-M, --module=<name>— Use a specific traceroute module-O, --options=<opts>— Options specific to a module-A, --as-path-lookups— Perform AS path lookups for each hop-e, --extension— Show ICMP extensions-a, --as-path-lookups— Print AS numbers for each hop-d, --debug— Enable socket-level debugging-n— Do not resolve IP addresses to hostnames-r— Bypass routing tables, send directly to a host on an attached network-v, --verbose— Verbose output--mtu— Discover path MTU along the route--back— Guess the number of hops in the backward direction-V, --version— Show version--help— Show help
5. Basic Usage
traceroute google.com
Expected output:
traceroute to google.com (142.250.183.14), 30 hops max, 60 byte packets
1 192.168.1.1 (192.168.1.1) 1.203 ms 1.150 ms 1.098 ms
2 10.10.0.1 (10.10.0.1) 5.221 ms 5.190 ms 5.150 ms
3 * * *
4 142.250.183.14 (142.250.183.14) 14.302 ms 14.100 ms 14.050 ms
6. Practical Examples
Example 1 — Basic UDP traceroute (default)
traceroute 8.8.8.8
1 192.168.1.1 1.1 ms 1.0 ms 1.0 ms
2 10.10.0.1 5.2 ms 5.1 ms 5.0 ms
3 8.8.8.8 12.4 ms 12.1 ms 12.0 ms
Example 2 — ICMP-based traceroute (useful when UDP is filtered)
sudo traceroute -I 8.8.8.8
1 192.168.1.1 1.0 ms 0.9 ms 1.0 ms
2 * * *
3 8.8.8.8 12.3 ms 12.0 ms 11.9 ms
Example 3 — TCP SYN traceroute to port 443 (bypasses many firewalls)
sudo traceroute -T -p 443 example.com
1 192.168.1.1 1.1 ms 1.0 ms 1.0 ms
2 93.184.216.34 20.1 ms 19.9 ms 19.8 ms
Example 4 — Limit maximum hops
traceroute -m 10 8.8.8.8
1 192.168.1.1 1.0 ms 1.0 ms 1.0 ms
...
10 8.8.8.8 12.5 ms 12.2 ms 12.1 ms
Example 5 — No DNS resolution (numeric only, faster)
traceroute -n 8.8.8.8
1 192.168.1.1 1.0 ms 1.0 ms 0.9 ms
2 10.10.0.1 5.1 ms 5.0 ms 5.0 ms
3 8.8.8.8 12.2 ms 12.1 ms 12.0 ms
Example 6 — Increase queries per hop for accuracy
traceroute -q 5 8.8.8.8
1 192.168.1.1 1.0 ms 1.0 ms 1.0 ms 0.9 ms 1.0 ms
Example 7 — Specify source interface
sudo traceroute -i eth0 8.8.8.8
1 192.168.1.1 1.1 ms 1.0 ms 1.0 ms
Example 8 — Set custom initial TTL to skip known hops
traceroute -f 3 8.8.8.8
3 10.10.0.1 5.0 ms 5.0 ms 5.1 ms
4 8.8.8.8 12.1 ms 12.0 ms 12.2 ms
Example 9 — Adjust wait time for slow/lossy links
traceroute -w 5 8.8.8.8
1 192.168.1.1 1.0 ms 1.0 ms 1.0 ms
2 * * *
Example 10 — Discover path MTU along the route
traceroute --mtu 8.8.8.8
1 192.168.1.1 1.0 ms 1.0 ms 1.0 ms <1500>
2 10.10.0.1 5.0 ms 5.0 ms 5.0 ms
3 8.8.8.8 12.1 ms 12.0 ms 12.0 ms
7. Common Use Cases
- Diagnosing network latency issues and identifying which hop introduces the delay.
- Mapping network topology between a source and a target during reconnaissance.
- Detecting firewalls/filtering devices that silently drop traffic (shown as
* * *). - Verifying routing changes or asymmetric routing paths.
- Bypassing basic UDP/ICMP filtering by switching to TCP SYN probes on a commonly allowed port (e.g., 80 or 443).
8. Automation with Bash
#!/bin/bash
# trace_targets.sh - traceroute a list of hosts and save results
TARGETS_FILE="targets.txt"
OUTDIR="./traceroute_results"
mkdir -p "$OUTDIR"
while read -r host; do
echo "[*] Tracing route to $host..."
traceroute -n "$host" > "$OUTDIR/${host}_trace.txt" 2>&1
done < "$TARGETS_FILE"
echo "[+] All traces saved in $OUTDIR"
9. Tips and Best Practices
- Use
-nto skip DNS resolution and speed up traces significantly, especially across many hops. - Try
-T(TCP) with a common port like 443 if default UDP traceroute results in all* * *due to firewall filtering. - Increase
-q(queries per hop) when trying to detect intermittent packet loss or load-balanced paths. - Remember that
* * *doesn’t always mean the path is broken — it often means the router is configured not to respond to expired-TTL probes, while still forwarding traffic normally. - Combine with
mtr(a real-time, continuously-updating alternative) for ongoing path/latency monitoring, thoughmtris a separate tool outside this section.
10. Troubleshooting
- All hops show
* * *: try switching probe type (-Ifor ICMP or-Tfor TCP) since UDP is commonly filtered by firewalls. - “traceroute: command not found”: install with
sudo apt install traceroute. - Permission denied on ICMP/TCP mode: some modes require raw socket access — run with
sudo. - Trace stops short of the destination: increase
-m(max hops) beyond the default 30, especially for geographically distant targets. - Inconsistent hop results between runs: the path may be load-balanced across multiple routes; increase
-qand interpret variability as expected behavior rather than an error.
11. References
- Linux man page:
man traceroute(installed locally) - Original traceroute concept: Van Jacobson, 1987 Usenet release
- Kali Linux tool page: https://www.kali.org/tools/traceroute/