How to Use the traceroute Command to Trace Network Paths in Linux

The ability to diagnose and troubleshoot network issues is a vital skill for anyone managing servers or maintaining connectivity across systems. One of the most useful tools for this purpose is the traceroute command. This utility lets you trace the path that network packets take from your machine to a destination, helping you identify bottlenecks, failures, or unexpected routing along the way.

In this article, you will learn what traceroute does, how to install it, how to use it to trace network paths, and how to interpret its output for troubleshooting and network management. You will also see advanced options, practical examples, and best practices for using traceroute effectively.

Prerequisites

• Access to a Linux machine or terminal
• Sudo privileges (for specific options, if needed)
• Basic familiarity with network concepts (such as IP addresses and routing)

Introduction to traceroute

The traceroute command is a network diagnostic tool that shows the route packets take as they travel from your local machine to a remote host. It works by sending packets with increasing Time-To-Live (TTL) values and measuring how long each “hop” takes to respond. Each hop typically represents a router or gateway along the way.

With traceroute, you can:

• See the path packets follow to a target host or IP address
• Identify slow or failing network segments
• Pinpoint where connectivity issues or bottlenecks occur

Installing traceroute

Most Linux distributions include traceroute by default. To check if it is installed, run:

$ traceroute --version

If you see version information, you are ready to go. If you see “command not found,” install it using your package manager.

On Ubuntu / Debian

1. Step 1: Update package lists:

   $ sudo apt update

2. Step 2: Install traceroute:

   $ sudo apt install traceroute

On CentOS / RHEL

1. Step 1: Install traceroute:

   $ sudo yum install traceroute

On Fedora

1. Step 1: Install traceroute:

   $ sudo dnf install traceroute

After installation, verify that traceroute is available:

$ traceroute --version

Basic Usage of traceroute

The simplest way to use traceroute is to provide a destination hostname or IP address:

$ traceroute example.com

or

$ traceroute 93.184.216.34

By default, traceroute sends UDP packets and displays each hop’s IP address, hostname (if available), and round-trip time (RTT).

Example Output

traceroute to example.com (93.184.216.34), 30 hops max, 60 byte packets
 1  192.168.1.1 (192.168.1.1)  2.123 ms  1.876 ms  1.765 ms
 2  10.0.0.1 (10.0.0.1)  5.234 ms  5.112 ms  5.078 ms
 3  203.0.113.1 (203.0.113.1)  12.245 ms  12.199 ms  12.150 ms
 ...
 8  93.184.216.34 (93.184.216.34)  52.404 ms  52.287 ms  52.130 ms

• Each numbered line represents a hop between routers or networks.
• The IP address and (sometimes) the hostname of each hop appear.
• Times are the round-trip times for three probe packets sent to that hop.

Understanding traceroute Output

Each line in the traceroute output reveals network information:

• Hop Number: The sequence in the route (starting from your computer).
• Hostname/IP: The resolved name (if available) and IP address of the hop.
• Round-Trip Times: Three time values in milliseconds, showing how long it took for each probe to reach the hop and return.

If a hop does not respond, you may see an asterisk (*). Multiple asterisks can indicate packet loss, a firewall, or an unreachable network device.

Common Scenarios

• Consistently High RTTs at a specific hop may indicate congestion or a slow router.
• Asterisks (*) mean that no reply was received from the hop—this may be normal for some routers configured to ignore traceroute requests.
• Sudden TTL Expiration or the route stopping before reaching the target may signal a break or block in the connection.

Using traceroute with Options

traceroute supports several command-line options to change its behavior or adapt to different networks.

Specify Maximum Number of Hops

By default, traceroute sends probes up to 30 hops. You can change this with the -m flag:

$ traceroute -m 20 example.com

Change the Number of Queries per Hop

By default, traceroute sends three probes per hop. To increase or decrease this, use the -q option:

$ traceroute -q 5 example.com

Use ICMP Instead of UDP

Some networks block UDP-based traceroute probes. You can use ICMP Echo Request packets (like ping) with the -I option:

$ sudo traceroute -I example.com

ICMP-based traceroute may require root privileges.

Use TCP Packets

If both UDP and ICMP are blocked or filtered, try using TCP probes with the -T option:

$ sudo traceroute -T example.com

This is useful for tracing through firewalls that allow only certain traffic.

Set Source Interface or Address

On multi-homed systems, choose the outgoing interface or source address:

$ traceroute -i eth1 example.com

$ traceroute -s 192.0.2.10 example.com

Resolve Hostnames

By default, traceroute tries to resolve hostnames. Use the -n flag to display only IP addresses (faster for large traces):

$ traceroute -n example.com

Real-World Examples

Trace the Path to a Website

1. Step 1: Run traceroute:

   $ traceroute google.com

2. Observe the listed hops, note any delays, and identify where the path changes from your ISP to the wider internet.

Identify Network Bottlenecks

If your connection is slow, run traceroute to a problematic site. Look for a hop with significantly higher round-trip times than the earlier ones—this may indicate congestion or a routing issue.

Troubleshoot VPN or Tunnel Connectivity

Use traceroute to see where the connection stops. This can help you identify whether the problem is inside your local network, your ISP, or the remote endpoint.

Trace Local Network Devices

1. Step 1: Run traceroute to a local device:

   $ traceroute 192.168.1.100

2. Use this to map how traffic flows between devices on your LAN.

Advanced traceroute Features

• Increase or Decrease Packet Size
  Set the probe packet size (in bytes):

  $ traceroute -w 64 example.com

  Larger packets can help test for MTU issues or fragmentation.

• Change Wait Time for Replies
  Set how long to wait (in seconds) for each reply:

  $ traceroute -w 2 example.com

• Log Output to a File
  Redirect output for later analysis:

  $ traceroute example.com > traceroute_example.txt

• Perform Reverse DNS Lookups
  By default, traceroute performs reverse DNS lookups to display hostnames. Disable this with -n for faster results.
• Use IPv6
  To trace a path using IPv6, use the traceroute6 command or traceroute -6:

  $ traceroute -6 ipv6.google.com

Interpreting Complex traceroute Results

• Unreachable Hosts: If the trace stops before reaching the destination, the problem may be a firewall, routing policy, or device failure.
• Asymmetric Routing: The path to the destination may differ from the path back. Use tools like mtr or request information from the remote side for comparison.
• Load Balancing: If you see different IPs for the same hop number across the three probes, the network may be using load balancing.

Security and Privacy Considerations

Some organizations filter or block traceroute packets to prevent reconnaissance or to reduce network load. If traceroute stops at a firewall or router, or if all hops show asterisks, this may be the reason.

NOTE: Do not use traceroute for unauthorized scanning or on networks where you lack permission.

Best Practices for traceroute

• Always use descriptive destination addresses to avoid confusion.
• Start with fewer probes and increase only if needed.
• Use -n for faster traces if you do not need hostnames.
• Combine with other tools like ping, mtr, or whois for thorough troubleshooting.
• Document your findings when diagnosing persistent issues.

Alternative Tools

• mtr – Combines traceroute and ping for real-time analysis.
• tracepath – A simpler alternative with automatic MTU discovery.
• pathping – Available on Windows, providing hop-by-hop loss reports.

Troubleshooting traceroute

• traceroute: command not found
  If you receive this error, install the package as described earlier.
• All Hops Show Asterisks
  This often means that intermediate devices are dropping or ignoring traceroute packets. Try using the -I or -T options to change the probe type.
• Destination Unreachable
  If the trace completes but shows “Destination Host Unreachable,” check routing tables and firewall rules on both ends.
• Inconsistent Results
  Some routers limit the rate of responses or treat traceroute differently than regular traffic. Run several traces at different times to confirm persistent issues.

Conclusion

The traceroute command is an essential tool for anyone managing or troubleshooting Linux systems and networks. By revealing the path your data takes across the network, traceroute helps you pinpoint connectivity problems, analyze performance issues, and understand your network’s topology. Whether you are a system administrator, network engineer, or curious user, mastering traceroute gives you powerful insight into network behavior.

Take time to explore its options, combine it with other diagnostic tools, and practice interpreting its output. With these skills, you can quickly and effectively respond to network challenges and keep your systems running smoothly.