A plain-language guide to traceroute output: what each hop means, why some show asterisks, and how to spot where a network path actually breaks.
Traceroute lists every router your packets pass through on the way to a host and how long each one took to answer. It is the best tool for answering "where does it break?" — but its output is easy to misread.
Every IP packet carries a TTL (time to live) that each router decrements by one. When it hits zero, the router drops the packet and sends back an error. Traceroute sends packets with TTL 1, 2, 3 and so on, so each router along the path reveals itself in turn. Each line of output is one hop: the router's address, its hostname if it has one, and the round-trip time.
ae1.fra.example.net for Frankfurt.A line of * * * means that router did not reply in time. Many routers rate-limit or ignore traceroute probes while still forwarding traffic normally. If later hops respond, the asterisks are harmless. Only asterisks that continue all the way to the end point at a real break — and the break is right after the last hop that answered.
A single slow hop in the middle often means nothing: routers answer traceroute at low priority. What matters is whether the extra latency carries through to every hop after it. If hop 7 jumps from 20 ms to 150 ms and every later hop is also around 150 ms, the slow link is between hops 6 and 7. A jump of that size usually means the path crossed an ocean — normal for a host on another continent.
Firewalls treat these differently. Classic Unix traceroute uses UDP, Windows tracert uses ICMP, and TCP traceroute to port 443 looks like ordinary web traffic, so it is the most likely to reach a host behind a strict firewall. The online traceroute lets you pick the protocol and port.
Internet routing is asymmetric and differs by region: the path from Germany has nothing in common with the path from Japan. Running traceroute from several countries at once shows whether a failure is local to one carrier or close to the destination. If every location stops at the same final hops, the problem is near the host. If only one region fails, it is a routing or peering issue in that region.
Traceroute shows the path; a ping test shows how stable the end-to-end connection is over several packets. Use both: ping to detect packet loss, traceroute to locate it. Our guide to latency and packet loss explains what values are normal.