2026-09-24 · IPV4 Scanner
A traceroute lists every router a packet passes through on its way to a destination, with the round trip time to each one. When something's slow or unreachable, it's how you find out where instead of just that. It's also one of the most misread tools in networking, because half the things that look alarming in the output are completely normal.
So before you panic at a row full of asterisks, here's what the numbers actually mean.
Every packet carries a hop limit called the TTL, and each router it passes knocks that number down by one. When it hits zero, the router throws the packet away and sends back a little "expired" notice. Traceroute abuses this on purpose. It sends a packet with a limit of one, then two, then three, collecting the reply from each router in turn.
That's why the output is a numbered list instead of one answer, and why later lines take longer than earlier ones. Each line is a separate measurement to a point a bit further away.
A hop that shows asterisks or "no reply" is just a router that's been told not to answer expired packets. Loads of them are configured that way. It's a policy choice, not a fault, and the trace carries straight on past it. A gap in the middle of an otherwise healthy path isn't worth a second look.
What is worth attention is a trace that goes quiet and never comes back. That usually means a firewall near the destination is dropping the probes, and the host itself might be perfectly reachable on port 80 or 443. Before you conclude anything, confirm with a ping test or just try loading the site.
Look for the jump. A step from 5 ms to 80 ms between two hops is a long-distance link, usually a subsea cable or a continental crossing, and it's expected. A step to 300 ms where everything after it also sits at 300 ms points at a genuinely congested or badly routed link.
Here's the one that fools people. A single hop showing a big number while every hop after it is fast is not a problem. Routers treat "reply to an expired packet" as their lowest-priority job, so a busy one answers slowly while still forwarding real traffic at full speed. Only a slowdown that continues through the rest of the path means anything. One slow line in the middle, surrounded by fast ones, is noise.
Internet routing is asymmetric. The path your packets take to a server is often not the path its replies take home, and a traceroute only ever shows you the outbound half. This catches people constantly. If a trace looks spotless but the connection is still bad, the return path, which you can't see from your end, is the usual suspect. Diagnosing that properly needs a trace run from the other side.
The classic traceroute uses ICMP, and plenty of networks filter it. If your trace dies almost immediately, that's often why. Switching to TCP usually gets further, because a probe shaped like ordinary web traffic sails through firewalls that would drop a raw ICMP packet. UDP is a third option that some networks treat differently again. If one protocol stops short, trying another is the first thing to do, not the last.
Running the trace from more than one place helps too. A peering problem that only affects traffic from Asia is invisible from a European trace, which is why our global traceroute runs from six continents at once. A route that's clean from one and broken from another tells you the problem is regional, not yours.
What do the asterisks mean?
That router chose not to answer. It's a config choice, not a failure, and your packet still went through it to reach the next hop. Only worry if the trace never recovers afterward.
Why does the traceroute stop before reaching my server?
Almost always a firewall close to the destination dropping the probes. The server can be completely reachable over HTTP while refusing traceroute. Try the TCP option, which more firewalls let through.
One hop shows a huge time but the rest are fast. Is that bad?
No. Answering expired packets is the lowest-priority thing a router does, so a busy one replies slowly while forwarding real traffic fine. A slow hop only counts if every hop after it is slow too.
Why do traces from different countries look so different?
Because they genuinely take different routes through different networks. That's the whole value of running several at once. A problem affecting only one region shows up immediately when you can compare.
Is a traceroute the same as a ping?
No. A ping measures the round trip to the destination and nothing in between. A traceroute maps every step along the way. Use ping to answer "is it reachable and how far," and traceroute to answer "where does it break."