computing Computing is any goal-oriented activity requiring, benefiting from, or creating computing machinery. It includes the study and experimentation of algorithmic processes, and development of both hardware and software. Computing has scientific, ...

, traceroute and tracert are

computer network A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are ...

diagnostic commands for displaying possible routes (paths) and measuring transit delays of packets across an

Internet Protocol The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet. ...

(IP) network. The history of the route is recorded as the round-trip times of the packets received from each successive host (remote node) in the route (path); the sum of the mean times in each hop is a measure of the total time spent to establish the connection. Traceroute proceeds unless all (usually three) sent packets are lost more than twice; then the connection is lost and the route cannot be evaluated. Ping, on the other hand, only computes the final round-trip times from the destination point. For

Internet Protocol Version 6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communications protocol that provides an identification and location system for computers on networks and routes traffic across the Internet. IP ...

(IPv6) the tool sometimes has the name traceroute6 and tracert6.

Implementations

The

command Command may refer to: Computing * Command (computing), a statement in a computer language * COMMAND.COM, the default operating system shell and command-line interpreter for DOS * Command key, a modifier key on Apple Macintosh computer keyboards * ...

traceroute is available on many modern

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ef ...

s. On

Unix-like A Unix-like (sometimes referred to as UN*X or *nix) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Unix-li ...

systems such as

FreeBSD FreeBSD is a free and open-source Unix-like operating system descended from the Berkeley Software Distribution (BSD), which was based on Research Unix. The first version of FreeBSD was released in 1993. In 2005, FreeBSD was the most popular ...

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and la ...

, and

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, whi ...

it is available as a command line tool. Traceroute is also graphically accessible in macOS within the ''Network Utilities'' suite; these utilities have been deprecated since the release of

macOS Big Sur macOS Big Sur (version 11) is the seventeenth major release of macOS, Apple Inc.'s operating system for Macintosh computers. It was announced at Apple's Worldwide Developers Conference (WWDC) on June 22, 2020, and was released to the publi ...

Microsoft Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for ...

and

ReactOS ReactOS is a free and open-source operating system for amd64/i686 personal computers intended to be binary-compatible with computer programs and device drivers made for Windows Server 2003 and later versions of Windows. ReactOS has been not ...

provide a program named tracert that performs the same route-tracing function.

Windows NT Windows NT is a proprietary graphical operating system produced by Microsoft, the first version of which was released on July 27, 1993. It is a processor-independent, multiprocessing and multi-user operating system. The first version of Win ...

-based operating systems also provide PathPing, with similar functionality. The ReactOS version was developed by Ged Murphy and is licensed under the GPL. On

operating systems, traceroute sends, by default, a sequence of

User Datagram Protocol In computer networking, the User Datagram Protocol (UDP) is one of the core communication protocols of the Internet protocol suite used to send messages (transported as datagrams in packets) to other hosts on an Internet Protocol (IP) netwo ...

(UDP) packets, with destination port numbers ranging from 33434 to 33534; the implementations of traceroute shipped with

NetBSD NetBSD is a free and open-source Unix operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was forked. It continues to be actively developed and is ava ...

OpenBSD OpenBSD is a security-focused, free and open-source, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. According to the website, the OpenBSD project e ...

DragonFly BSD DragonFly BSD is a free and open-source Unix-like operating system forked from FreeBSD 4.8. Matthew Dillon, an Amiga developer in the late 1980s and early 1990s and FreeBSD developer between 1994 and 2003, began working on DragonFly BSD ...

, and

include an option to use ICMP Echo Request packets (''-I''), or any arbitrary protocol (''-P'') such as UDP, TCP using TCP SYN packets, or ICMP. On Windows, tracert sends ICMP Echo Request packets, rather than the UDP packets traceroute sends by default. The time-to-live (TTL) value, also known as ''hop limit'', is used in determining the intermediate routers being traversed towards the destination. Traceroute sends packets with TTL values that gradually increase from packet to packet, starting with TTL value of one. Routers decrement TTL values of packets by one when routing and discard packets whose TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded. For the first set of packets, the first router receives the packet, decrements the TTL value and drops the packet because it then has TTL value zero. The router sends an ICMP Time Exceeded message back to the source. The next set of packets are given a TTL value of two, so the first router forwards the packets, but the second router drops them and replies with ICMP Time Exceeded. Proceeding in this way, traceroute uses the returned ICMP Time Exceeded messages to build a list of routers that packets traverse, until the destination is reached and returns an ICMP Destination Unreachable message if UDP packets are being used or an ICMP Echo Reply message if ICMP Echo messages are being used. The timestamp values returned for each router along the path are the delay ( latency) values, typically measured in milliseconds for each packet. The sender expects a reply within a specified number of seconds. If a packet is not acknowledged within the expected interval, an asterisk is displayed. The Internet Protocol does not require packets to take the same route towards a particular destination, thus hosts listed might be hosts that other packets have traversed. If the host at hop #N does not reply, the hop is skipped in the output. If a network has a firewall and operates both Windows and Unix-like systems, more than one protocol must be enabled inbound through the firewall for traceroute to work and receive replies. Some traceroute implementations use TCP packets, such as ''tcptraceroute'' and

layer four traceroute Layer Four Traceroute (LFT) is a fast, multi-protocol traceroute engine, that also implements numerous other features including AS number lookups through regional Internet registries and other reliable sources, Loose Source Routing, firewall and ...

(lft). PathPing is a utility introduced with

that combines ping and traceroute functionality.

MTR The Mass Transit Railway (MTR) is a major public transport network serving :Hong Kong. Operated by the MTR Corporation Limited (MTRCL), it consists of heavy rail, light rail, and feeder bus service centred on a 10-line rapid transit network ...

is an enhanced version of ICMP traceroute available for Unix-like and Windows systems. The various implementations of traceroute all rely on ICMP Time Exceeded (type 11) packets being sent to the source. On Linux, ''tracepath'' is a utility similar to traceroute, with the primary difference of not requiring

superuser In computing, the superuser is a special user account used for system administration. Depending on the operating system (OS), the actual name of this account might be root, administrator, admin or supervisor. In some cases, the actual name of t ...

privileges.

Cisco Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational digital communications technology conglomerate corporation headquartered in San Jose, California. Cisco develops, manufactures, and sells networking hardware, ...

's implementation of traceroute also uses a sequence of UDP datagrams, each with incrementing TTL values, to an invalid port number at the remote host; by default, UDP port 33434 is used. An extended version of this command (known as the ''extended traceroute'' command) can change the destination port number used by the UDP probe messages.

Usage

Most implementations include at least options to specify the number of queries to send per hop, time to wait for a response, the hop limit and port to use. Invoking traceroute with no specified options displays the list of available options, while ''man traceroute'' presents more details, including the displayed error flags. An example on Linux: $ traceroute -w 3 -q 1 -m 16 example.com traceroute to example.com (93.184.216.34), 16 hops max, 52 byte packets 1 192.x.x.x (192.x.x.x) 5.152 ms 2 10.x.x.x (10.x.x.x) 12.767 ms 3 172.x.x.x (172.x.x.x) 11.638 ms 4 172.x.x.x (172.x.x.x) 13.193 ms 5 xxx.x.x.x.cox.net (68.x.x.x) 20.624 ms 6 xxx.xxx.xxx.edgecastcdn.net (192.x.x.x) 56.205 ms 7 xxx.xxx.xxx.edgecastcdn.net (192.x.x.x) 24.573 ms 8 * 9 * 10 93.x.x.x (93.x.x.x) 22.810 ms 11 93.x.x.x (93.x.x.x) 20.235 ms In the example above, selected options are to wait for three seconds (instead of five), send out only one query to each hop (instead of three), limit the maximum number of hops to 16 before giving up (instead of 30), with ''example.com'' as the final host. On line 8 and 9 (TTLs 8 and 9) it shows asterisks where the router did not respond within the timeout. Traceroute can be used to help identify incorrect routing table definitions or firewalls that may be blocking ICMP traffic, A correct traceroute response does not guarantee connectivity for applications as a firewall may permit ICMP packets but not permit packets of other protocols. Traceroute is also used by penetration testers to gather information about network infrastructure and IP address ranges around a given host. It can also be used when downloading data, and if there are multiple mirrors available for the same piece of data, each mirror can be traced to get an idea of which mirror would be the fastest to use.

Origins

The traceroute

manual page A man page (short for manual page) is a form of software documentation usually found on a Unix or Unix-like operating system. Topics covered include computer programs (including library and system calls), formal standards and conventions, and ...

states that the original traceroute program was written by Van Jacobson in 1987 from a suggestion by

Steve Deering Stephen Deering is a former Fellow at Cisco Systems, where he worked on the development and standardization of architectural enhancements to the Internet Protocol. Prior to joining Cisco in 1996, he spent six years at Xerox's Palo Alto Research ...

, with particularly cogent suggestions or fixes from C. Philip Wood, Tim Seaver and Ken Adelman. The author of the ping program, Mike Muuss, states on his website that traceroute was written using kernel ICMP support that he had earlier coded to enable raw ICMP sockets when he first wrote the ping program.

Limitations

Traceroute limitations are well known and should be taken into account when using the tool. For example, traceroute does not discover paths at the router level, but at the interface level. Another limitation appears when routers do not respond to probes or when routers have a limit for ICMP responses. In the presence of traffic load balancing, traceroute may indicate a path that does not actually exist; to minimize this problem there is a traceroute modification called Paris-traceroute, which maintains the flow identifier of the probes to avoid load balancing.

References

External links

* : Traceroute using an IP Option Internet RFC
How traceroute works – InetDaemon

Tracert
Windows XP Command-line reference {{Windows commands Network analyzers Free network management software