How to read a traceroute
A traceroute lists the routers (hops) to a target and their latency. Learn to tell RTT spikes and single-hop loss from real loss, and to spot asymmetric paths.
Last updated:
A traceroute is a diagnostic tool. It lists the routers (hops) along the path from your host to a target, with the latency at each one. It works by sending packets with an increasing TTL field (IPv4) or Hop Limit (IPv6): every router on the path decrements the value by one, and when it reaches zero the router returns an ICMP Time Exceeded message (RFC 792 for IPv4, RFC 4443 for IPv6). From the source address of those messages, traceroute reconstructs the successive hops. MTR combines traceroute with ping and refreshes the measurements in a loop, so it shows packet loss and latency at each hop in real time.
How to read the hops
Each line is one hop: the hop number, the IP address (often with reverse DNS) and a few round-trip time (RTT) measurements. Read the list top to bottom, from your network toward the target. PTR names frequently reveal the location and operator, for example ae-1.war suggesting Warsaw. Watch for these signals:
- An RTT jump between hops, which usually means a longer link, such as crossing a border or reaching another city.
- Asterisks (* * *) on a hop, which mean no ICMP reply, not a broken path.
- A change of domain in the reverse DNS, marking a transition between networks (for example from an exchange's network into your operator).
- The last hop, which should be the target address. If it is missing, the target simply does not answer probes.
- Loops or repeating addresses, which can signal a routing problem.
Latency spikes versus real packet loss
The most common mistake is confusing loss at a single intermediate hop with real packet loss. Routers treat generating ICMP Time Exceeded messages as a low-priority control-plane task, so under load they reply late or not at all. That is why an RTT spike or 50 percent loss at hop 5, while hops 6 and beyond show 0 percent loss and low latency, is a measurement artifact, not a problem. Real loss begins at a hop and persists to the end of the path, including the target. In MTR, read the Loss column mainly on the final hop, and check whether the effect is sustained over time.
Asymmetric paths
Traceroute shows only the path in one direction, from you to the target. The return traffic can take an entirely different route, and on the internet asymmetry is the norm, because each operator chooses its outbound path with its own BGP policy. RTT values are round-trip times, so the latency measured at an intermediate hop also includes the unknown return path from that router. For this reason a sudden RTT jump in the middle of a trace need not mean a problem at that hop, but rather a longer or congested return path. To diagnose both directions, run a traceroute from each end or use a looking glass on the operator at the far side.
Diagnostics with the AS202520 SkyPass network
Because a traceroute shows only one direction, sound diagnosis needs a vantage point on the other side. AS202520 SkyPass provides a public looking glass with ping and MTR tests for IPv4 and IPv6 from our infrastructure, including a location in Wrocław, so you can trace the return path from our network to yours. As an operator peering at the Polish internet exchanges (THINX, TPIX, WRIX, 1-IX), we offer short, local paths to Polish networks, which shortens the route and makes results easier to interpret. With our IP transit and peering services, our NOC helps determine on which side the latency or loss originates.
Frequently asked questions
What do the asterisks in a traceroute mean?
Asterisks (* * *) mean a hop did not return an ICMP message within the timeout. Usually the router deliberately does not answer probes or rate-limits ICMP, not that the path is broken. If later hops reply normally, the route is working.
Why do I see high loss at one hop but zero at the target?
Because routers give ICMP Time Exceeded generation low priority and may drop it under load. Loss only at an intermediate hop that does not persist to the end of the path is a measurement artifact. Real loss is the loss visible on the final hop.
How does MTR differ from traceroute?
Traceroute runs a single pass of the path, while MTR combines traceroute with ping and refreshes measurements in a loop. This lets MTR show packet loss and latency per hop over time, making it easier to tell momentary spikes from sustained problems.
Why does latency rise at a middle hop and drop at the next one?
This usually comes from an asymmetric path and how RTT is measured. The latency at an intermediate hop also includes the return path from that router, which may be longer. If later hops show lower RTT, the middle reading is misleading, not a problem.