Online Traceroute

About Traceroute

Every hop between this application's server and a host, with the time each one took. It is the tool for "where is the latency" and "where does it stop", and it answers both by watching packets die on purpose.

A traceroute works by sending packets whose time-to-live is one, then two, then three. Each router that decrements the TTL to zero discards the packet and reports back — so the sequence of reports is the sequence of routers. That reporting is ICMP, and receiving ICMP needs a raw socket, which is why this runs through the system's own traceroute rather than being implemented here: Node cannot open one, and should not be given the privilege to.

The route is measured from this application's server, not from your machine. That is a real limitation and not a detail — the path from a datacentre to a host has little to do with the path from your desk. For your own path, run traceroute or tracert locally.

Two things in the output mislead almost everybody. A hop that does not reply is normal: routers routinely decline to answer these probes, and a gap in the middle of a route is not a fault. And a high time at one hop that does not carry forward to the next is that router deprioritising the probe — a delay only counts if every hop after it is also slow.

Where it helps

• Shows every hop with its own time, so a delay can be attributed to a place rather than to the whole path.
• Keeps the hops that did not answer, because a gap in a route is information.
• Says whether the destination was actually reached, rather than just that the command finished.
• Explains the two readings people get wrong: a silent hop, and a spike that does not carry forward.

Limits

• It runs from this application's server. Your own path to a host is a different path, and for that you need to run traceroute locally.
• It needs the system traceroute and the privilege to send raw packets, which many container deployments do not grant. The error says so plainly when that is the case.
• A route that does not complete is usually a firewall dropping the probes, not a broken path — the host may be perfectly reachable over TCP.
• The reverse path can differ from the forward one, and a traceroute only shows the forward one.

Frequently asked questions

Why does it stop before reaching the host?

Almost always because something along the way is dropping the probes — many networks filter them, and many hosts do not reply to them at all. It is not evidence that the host is unreachable; check with the Port Checker or the TCP Ping, which use ordinary connections.

One hop shows 200 ms and the next shows 20. Is that hop broken?

No. Generating a reply is low-priority work for a router, so a busy one answers slowly while forwarding traffic at full speed. A delay is only real if it persists in every hop after it — the times are cumulative from the source, so a genuine bottleneck raises everything downstream.

Can I trace from my own connection?

Not through a browser — sending these packets is not something a web page can do. Run traceroute host on macOS or Linux, or tracert host on Windows. What this tool gives you is the path from this server, which is useful for comparing against yours.

Related tools

• Ping (TCP) — Measure connection latency with repeated TCP probes
• Port Checker — Test whether TCP ports accept connections
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature