How hops are discovered
Traceroute relies on the time-to-live field in every IP packet. The first probe is sent with a TTL of 1, so the first router decrements it to zero, discards the packet and sends back an ICMP Time Exceeded message that reveals its address. The next probe uses TTL 2, and so on, until a probe reaches the target or the hop limit is hit. Three probes go out per hop, which is where the three RTT columns come from.
The server runs the operating system's own traceroute: tracert on Windows, which probes with ICMP echo, or traceroute on Linux, which by default sends UDP packets to high ports. Both are run with numeric output and the hop limit you select (10, 15 or 20). The tool then looks up a reverse DNS name for every router address itself, since that lookup is disabled in the command for speed.
If the command produces no usable hops, the page shows an error (Traceroute returned no hops for this target) rather than an empty or made-up path. Targets are resolved and checked first, and private or reserved addresses, or names that resolve to them, are refused.
Columns in the hop table
Each row is one TTL value. Router IP is the address that answered, or an asterisk when none did. Hostname shows the reverse DNS name, Unresolved PTR when the address has no PTR record, and a dash for a silent hop. RTT 1 to 3 are the three probe times, with an asterisk for a probe that got no reply, and Avg Latency is the mean of the ones that did, coloured green up to 75 ms, amber up to 150 ms and red beyond.
Status is SUCCESS when the hop answered at least once and TIMEOUT when all three probes were silent. The map above the table draws the same hops as a chain from the probe source to the target, with silent hops marked as filtered. Reverse names are often the most informative column: operators encode city codes and roles in them, so a name containing lhr or fra tells you the packet passed through London or Frankfurt.
The hop parser reads IPv4 router addresses. A name with both address families is traced to its first IPv4 address, which is shown next to the target. An IPv6-only host will not produce a readable trace here.
Telling a real bottleneck from a slow router
Latency should climb gently from hop to hop. A spike at one hop that vanishes on the next is almost always the router generating its ICMP reply slowly, because that work is done by its control plane at low priority while forwarding carries on at full speed. A rise that persists through every later hop, on the other hand, is real: either a long link, such as a submarine cable, or congestion.
Silent hops in the middle of a path, followed by hops that answer, mean a router that does not send Time Exceeded messages. They are harmless. Silent hops from some point to the end of the table mean the probes stopped getting answers: a firewall at the destination blocking ICMP or UDP, or the hop limit was reached before the target. Raise the limit to 20 and run a ping, whose TCP fallback can confirm the host is up.
Remember that each RTT covers the return path too, and the reply may come back a different way than the probe went out. A hop that looks slow may be slow only on its path back to the server. Compare two or three runs before drawing conclusions from a single trace.
Patterns you will see often
A few shapes come up in most traces and are worth recognising on sight. None of them is a fault by itself. What matters is whether the final hops answer and how their latency compares with what distance alone would explain.
- The first hops sit inside the hosting provider's network and answer in a millisecond or two. After that the packet leaves for a transit carrier.
- A jump of 60 to 150 ms at a single hop that stays for the rest of the trace is an intercontinental link.
- Private addresses such as 10.x.x.x in the middle of the path are router interfaces inside a carrier's network, not a misconfiguration.
- Fewer hops than expected often means an MPLS core that hides its internal routers from traceroute.
- The same two addresses alternating for several hops indicate a routing loop. The packet is bouncing between them.
- A final hop belonging to a CDN or cloud edge rather than your own server means the site is behind a proxy. An IP lookup on that address names the network.
Limits and rate limits
The trace starts at the DNSfinder server, so it shows the server's route, not yours. For your own path run tracert example.com on Windows or traceroute example.com on macOS and Linux. mtr, where installed, repeats the trace continuously and gives loss per hop. Running both and comparing the point where the paths merge is a quick way to locate a problem.
Each silent hop costs three probe timeouts, so a path with many filtered routers takes longer, and the whole run has a time budget. A trace that hits it shows the hops gathered so far. The hop limit is capped at 20. Traces are limited per visitor IP per minute and per day, and the hop list can be copied as JSON or downloaded as CSV. Nothing you trace is stored, as the privacy policy states.