How Traceroute Works: TTL Manipulation & Route Discovery

The Ingenious Mechanics of Traceroute

Traceroute (known as `tracert` on Windows) is a diagnostic utility that identifies every intermediate router along the network path between source and destination.

Client (TTL=1) ──▶ Router 1 (TTL=0) ──▶ Returns ICMP Time Exceeded (Type 11) [Hop 1 Identified]
Client (TTL=2) ──▶ Router 1 ──▶ Router 2 (TTL=0) ──▶ Returns ICMP Time Exceeded [Hop 2 Identified]
Client (TTL=3) ──▶ Router 1 ──▶ Router 2 ──▶ Target Host (Echo Reply / Port Unreachable) [Complete]

Interpreting Traceroute Anomalies

• Sudden Latency Spikes: If latency increases at Hop 4 and remains elevated across all subsequent hops, the delay is genuine transit congestion or transoceanic fiber latency. If the spike only occurs on a single intermediate hop and drops on subsequent hops, the intermediate router is simply rate-limiting ICMP generation.
• Asymmetric Routing: Packets returning from the target host often take a completely different physical path than outbound packets due to BGP routing policies.

Example: A Hop With a Rate-Limited Router (Illustrative)

 3   14 ms   13 ms   15 ms  core-edge-1.isp.net [198.51.100.1]
 4    *       *       *     Request timed out
 5   16 ms   15 ms   17 ms  transit-backbone.net [203.0.113.9]

Hop 4 timing out on all three probes while hops 3 and 5 respond normally, with latency staying flat across the gap, is the signature of a router that simply declines to generate ICMP Time Exceeded replies — not a routing failure. If hop 5's latency had jumped instead of staying flat, that would point to real congestion at or after hop 4.

Trace Routes in Real Time

Map network hops, measure intermediate transit latency, and inspect reverse DNS hostnames with our Traceroute Tool.