tracerouteTrace the routers between you and a host
traceroute lists every router on the path to a host, with three round-trip times per hop. Use it to see where a path breaks or where latency jumps, and whether the problem is in your network, your provider's or the destination's.
traceroute [-n] [-I | -T] [-p PORT] [-q N] [-w SEC] [-m MAX_TTL] HOSTYou're on a fresh Ubuntu server and want to see the path your traffic takes to a public site.
sudoTCP probes need a raw socket (CAP_NET_RAW), so this method needs root. The default UDP method doesn't.
Every IP packet carries a TTL that each router decrements; a router that decrements it to 0 drops the packet and sends an ICMP Time Exceeded (type 11) back to the sender, from its own address. traceroute exploits that. It sends three probes with TTL 1, which die at the first router, then three with TTL 2, and so on, and prints the source of each Time Exceeded with the round-trip time. By default Linux traceroute uses UDP probes to high ports starting at 33434; when a probe finally reaches the destination, the host answers ICMP Port Unreachable and the trace stops. -I uses ICMP echo instead and -T sends TCP SYNs, which get through firewalls that only allow a service port. A * means no answer within the wait time: the router may simply not generate ICMP, or rate-limit it. Several addresses on one line show load-balanced (ECMP) paths.
Probes leave with TTL 1, 2, 3...; each router that drops one at TTL 0 reveals itself with an ICMP Time Exceeded.
traceroute sends a UDP packet to port 33434 with TTL 1. The first router decrements the TTL to 0, so it must drop the packet.
-nNo reverse DNS: print bare IPs (faster, clearer)-IUse ICMP Echo probes (like ping) instead of UDP-TUse TCP SYN probes (root); pair with -p 443 or -p 22-p PORTDestination port (base port for UDP, exact port for TCP)-q NProbes per hop (default 3)-w SECSeconds to wait for each reply (default 5)-m NMaximum number of hops (default 30)-f NStart from TTL N, skipping the first hops-4 / -6Force IPv4 or IPv6-ALook up the AS number of each hop (which network owns it)Reading * * * on one hop as packet lossMany routers don't generate ICMP Time Exceeded or rate-limit it. If later hops answer, traffic passes through that router fine.
Only worry when stars or loss continue all the way to the destination.Blaming the hop with the highest timeA router answers traceroute from its CPU, at low priority. A spike that disappears on the next hop is that router being lazy, not a slow link.
Look for latency that jumps and stays high on every later hop.Concluding HTTPS is broken because traceroute never reaches the hostDefault probes are UDP to high ports, which firewalls commonly drop.
sudo traceroute -T -p 443 hosttraceroute in a script with name resolution onReverse DNS lookups for every hop can take seconds each and the names are often stale.
traceroute -n hostTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox has no network, so trace the path to your own loopback with tracepath and read the output.
Write the traceroute command that skips DNS lookups, sends 1 probe per hop, waits 2 seconds per probe and stops after 15 hops, towards 10.0.2.15.
Write the command to trace to shop.devops-lab.io using TCP SYN probes on port 443. Why might you need it?
tracerouteTrace the routers between you and a host
traceroute lists every router on the path to a host, with three round-trip times per hop. Use it to see where a path breaks or where latency jumps, and whether the problem is in your network, your provider's or the destination's.
traceroute [-n] [-I | -T] [-p PORT] [-q N] [-w SEC] [-m MAX_TTL] HOSTYou're on a fresh Ubuntu server and want to see the path your traffic takes to a public site.
sudoTCP probes need a raw socket (CAP_NET_RAW), so this method needs root. The default UDP method doesn't.
Every IP packet carries a TTL that each router decrements; a router that decrements it to 0 drops the packet and sends an ICMP Time Exceeded (type 11) back to the sender, from its own address. traceroute exploits that. It sends three probes with TTL 1, which die at the first router, then three with TTL 2, and so on, and prints the source of each Time Exceeded with the round-trip time. By default Linux traceroute uses UDP probes to high ports starting at 33434; when a probe finally reaches the destination, the host answers ICMP Port Unreachable and the trace stops. -I uses ICMP echo instead and -T sends TCP SYNs, which get through firewalls that only allow a service port. A * means no answer within the wait time: the router may simply not generate ICMP, or rate-limit it. Several addresses on one line show load-balanced (ECMP) paths.
Probes leave with TTL 1, 2, 3...; each router that drops one at TTL 0 reveals itself with an ICMP Time Exceeded.
traceroute sends a UDP packet to port 33434 with TTL 1. The first router decrements the TTL to 0, so it must drop the packet.
-nNo reverse DNS: print bare IPs (faster, clearer)-IUse ICMP Echo probes (like ping) instead of UDP-TUse TCP SYN probes (root); pair with -p 443 or -p 22-p PORTDestination port (base port for UDP, exact port for TCP)-q NProbes per hop (default 3)-w SECSeconds to wait for each reply (default 5)-m NMaximum number of hops (default 30)-f NStart from TTL N, skipping the first hops-4 / -6Force IPv4 or IPv6-ALook up the AS number of each hop (which network owns it)Reading * * * on one hop as packet lossMany routers don't generate ICMP Time Exceeded or rate-limit it. If later hops answer, traffic passes through that router fine.
Only worry when stars or loss continue all the way to the destination.Blaming the hop with the highest timeA router answers traceroute from its CPU, at low priority. A spike that disappears on the next hop is that router being lazy, not a slow link.
Look for latency that jumps and stays high on every later hop.Concluding HTTPS is broken because traceroute never reaches the hostDefault probes are UDP to high ports, which firewalls commonly drop.
sudo traceroute -T -p 443 hosttraceroute in a script with name resolution onReverse DNS lookups for every hop can take seconds each and the names are often stale.
traceroute -n hostTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox has no network, so trace the path to your own loopback with tracepath and read the output.
Write the traceroute command that skips DNS lookups, sends 1 probe per hop, waits 2 seconds per probe and stops after 15 hops, towards 10.0.2.15.
Write the command to trace to shop.devops-lab.io using TCP SYN probes on port 443. Why might you need it?