What is Traceroute and How Does It Work?
Learn how traceroute maps each router hop using TTL and ICMP Time Exceeded messages — with a networking interview Q&A.
Expected Interview Answer
Traceroute is a network diagnostic tool that reveals the sequence of routers (hops) a packet passes through to reach a destination, by sending probe packets with incrementing Time-To-Live (TTL) values and recording which router sends back an ICMP "time exceeded" message at each hop.
Traceroute sends a series of probe packets, starting with TTL=1. The first router that receives it decrements the TTL to zero, discards the packet, and returns an ICMP "Time Exceeded" message identifying itself, which traceroute records as hop 1. It then sends a probe with TTL=2, which survives the first router but expires at the second, revealing hop 2, and so on, incrementing TTL until a probe finally reaches the destination and gets a normal reply (or an ICMP "port unreachable," depending on implementation). At each hop, traceroute typically sends three probes and reports the round-trip time for each, showing latency introduced at every step of the path. This makes it possible to see not just whether a destination is reachable, but exactly where along the path delay or packet loss is occurring, which is invaluable for isolating whether a problem is local, at an ISP, or at the destination itself.
- Reveals the full router path between source and destination
- Pinpoints exactly which hop introduces latency or packet loss
- Helps distinguish local, ISP, or destination-side network problems
- Uses incrementing TTL and ICMP time-exceeded messages to map each hop
AI Mentor Explanation
Traceroute is like tracking a message passed hand-to-hand across a chain of fielders before it reaches the captain at the boundary. You send a note that only travels to the first fielder before it is stamped “reached here” and sent back, then a second note allowed to travel one fielder further, and so on, each time learning exactly which fielder handled it and how long that hand-off took. By the time the note finally reaches the captain, you have a full list of every fielder in the relay chain and the delay each one added.
Step-by-Step Explanation
Step 1
TTL=1 probe
A probe packet with TTL=1 is sent; the first router decrements it to zero and replies with ICMP Time Exceeded.
Step 2
Increment TTL
Traceroute sends probes with TTL=2, 3, 4... each expiring one router further along the path.
Step 3
Record each hop
Each responding router’s address and round-trip time are recorded as one hop in the path.
Step 4
Reach destination
The process stops once a probe finally reaches the destination and receives a normal or port-unreachable reply.
What Interviewer Expects
- Correct definition: maps the router path using incrementing TTL values
- Explains ICMP Time Exceeded and how each hop is discovered
- Understands traceroute reveals per-hop latency, not just end-to-end reachability
- Knows some hops may show "*" if a router does not respond to ICMP
Common Mistakes
- Confusing traceroute with ping (traceroute maps the path, ping tests one endpoint)
- Assuming a "*" (no reply) hop always means that router is down
- Not knowing traceroute uses UDP or ICMP depending on the OS/implementation
- Forgetting that a high-latency hop mid-path does not necessarily mean the final destination is slow
Best Answer (HR Friendly)
“Traceroute shows you every stop your data makes on its way to a destination, kind of like tracking each waypoint a delivery truck passes through. It sends test packets that are designed to give up one step further each time, revealing every router along the path and how long each hop takes, which helps pinpoint exactly where a slowdown or connection problem is happening.”
Code Example
# Trace the route to a destination host
traceroute example.com
# Typical output:
# 1 192.168.1.1 (192.168.1.1) 1.2 ms
# 2 10.10.0.1 (10.10.0.1) 4.8 ms
# 3 isp-core-router.net (203.0.113.1) 12.1 ms
# 4 * * *
# 5 example.com (93.184.216.34) 18.7 msFollow-up Questions
- What does it mean when a traceroute hop shows "* * *"?
- How does traceroute differ from ping in what it reveals?
- What is the difference between UDP-based and ICMP-based traceroute?
- How would you use traceroute to isolate whether a slowdown is on your ISP or the destination side?
MCQ Practice
1. What field does traceroute manipulate to discover each hop?
Traceroute sends probes with incrementing TTL values so each router along the path expires and replies in turn.
2. What ICMP message does an intermediate router send back when a probe expires?
When TTL reaches zero, the router discards the packet and returns an ICMP Time Exceeded message.
3. What does traceroute reveal that a simple ping does not?
Traceroute maps every router hop along the path with round-trip time, not just the final destination’s reachability.
Flash Cards
What does traceroute manipulate to find each hop? — The TTL (Time-To-Live) field, incrementing it by one for each probe.
What message reveals a hop? — An ICMP Time Exceeded reply from the router that decremented TTL to zero.
Traceroute vs ping? — Traceroute maps the full path hop-by-hop; ping only tests the final endpoint.
What does "* * *" in a hop mean? — That router did not respond to the probe, often due to rate-limiting or ICMP being blocked.