How the Traceroute Works, Understanding Traceroute Output and Troubleshooting

How the TRACEROUTE Command Works
The traceroute command is used to discover the routes that packets actually take when traveling to their destination. The device (for example, a router or a PC) sends out a sequence of User Datagram Protocol (UDP) datagrams to an invalid port address at the remote host.
Three datagrams are sent, each with a Time-To-Live (TTL) field value set to one. The TTL value of 1 causes the datagram to “timeout” as soon as it hits the first router in the path; this router then responds with an ICMP Time Exceeded Message (TEM) indicating that the datagram has expired.
Another three UDP messages are now sent, each with the TTL value set to 2, which causes the second router to return ICMP TEMs. This process continues until the packets actually reach the other destination. Since these datagrams are trying to access an invalid port at the destination host, ICMP Port Unreachable Messages are returned, indicating an unreachable port; this event signals the Traceroute program that it is finished.
The purpose behind this is to record the source of each ICMP Time Exceeded Message to provide a trace of the path the packet took to reach the destination.
In the following example, the packet must travel through two routers ( and to get to host In this example, the default gateway is and the IP address of the router on the network is at


   Tracing route to over a maximum of 30 hops
   1     2 ms     3 ms     2 ms
   2    75 ms    83 ms    88 ms
   3    73 ms    79 ms    93 ms
   Trace complete.

The table below lists the characters that can appear in the traceroute command  output.
IP Traceroute Text Characters
nn msec
For each node, the round-trip time in milliseconds for the specified number of probes
The probe timed out
Administratively prohibited (example, access-list)
Source quench (destination too busy)
User interrupted test
Port unreachable
Host unreachable
Network unreachable
Protocol Unreachable
Unknown packet type
Troubleshooting with TRACEROUTE
The TRACEROUTE command can be used to determine where a packet stopped on the network.
TRACEROUTE is useful for troubleshooting large networks where several paths can be taken to arrive at the same point, or where many intermediate systems (routers or bridges) are involved.


Popular Posts