CybersLion

Traceroute Tools — How to Use traceroute, mtr, tcptraceroute & Pathping (Practical Guide)

 

Traceroute Tools — Complete Guide with Commands, Interpretation & Practical Labs 

Meta Description: Learn traceroute and related tools (mtr, tcptraceroute, Paris-traceroute, tracepath, pathping). Step-by-step commands, interpretation tips, and hands-on labs for network troubleshooting and reconnaissance.

1. Introduction

Traceroute is one of the first tools network engineers and ethical hackers reach for when they want to map the path packets take across an IP network. It reveals intermediate hops (routers), round-trip times (RTT), and helps diagnose routing issues, latency spikes, firewalls filtering ICMP, load balancing, and asymmetric paths.

This guide covers the most useful traceroute variants and complementary tools, practical command examples, how to interpret output, and lab exercises you can run in a safe environment.

2. What traceroute does (brief technical overview)

Traceroute discovers path hops by sending packets with incrementing TTL (Time To Live) values. Each router that decrements TTL to zero sends back an ICMP “Time Exceeded” message, revealing its IP and RTT. Variants differ in the packet type used:

  • Classic traceroute (Unix): often sends UDP packets by default (destined to high port numbers).

  • Windows tracert: uses ICMP Echo Request.

  • tcptraceroute / traceroute -T: sends TCP SYN packets — useful when ICMP/UDP are filtered.

  • mtr (My Traceroute): combines traceroute and ping in a live rolling report.

  • Paris-traceroute: accounts for load-balancing artifacts for more accurate path measurement.

  • tracepath (Linux): simpler traceroute-like tool without needing root privileges.

Understanding these differences is key to choosing the right tool during an audit.

3. Core Traceroute Tools & Installation

3.1 traceroute (Unix / Linux)

Install (Debian/Ubuntu):

sudo apt update && sudo apt install traceroute

Basic Usage:

traceroute example.com

UDP-based by default on many systems. Use -T for TCP, -I for ICMP on some implementations:

traceroute -T -p 80 example.com    # TCP to port 80
traceroute -I example.com          # ICMP-based

3.2 tracert (Windows)

Usage in Command Prompt:

tracert example.com

Windows tracert sends ICMP Echo Requests and displays hop-by-hop RTT.

3.3 mtr (My Traceroute) — interactive and continuous

Install:

sudo apt install mtr

Usage:

mtr example.com

Press c to change display, q to quit. For non-interactive report:

mtr -r -c 100 example.com > mtr_report.txt

-r = report mode; -c = number of pings per hop.

3.4 tcptraceroute / traceroute -T

Install tcptraceroute:

sudo apt install tcptraceroute

Usage:

tcptraceroute example.com 443
# Or with traceroute supporting -T
sudo traceroute -T -p 443 example.com

Use TCP when ICMP/UDP probes are blocked but TCP to specific ports is allowed.

3.5 Paris-traceroute (handles load balancing)

Install (Debian/Ubuntu):

sudo apt install paris-traceroute

Usage:

paris-traceroute example.com

Paris-traceroute preserves flow identifiers to prevent load-balancing from misrepresenting paths.

3.6 tracepath (no root required)

Usage:

tracepath example.com

Simpler, automatic MTU discovery along path.

4. Practical Examples & Labs

Important: Always run tests only on networks/systems you own or have explicit permission to test.

Lab 1 — Basic Path Discovery

traceroute example.com
# or (Windows)
tracert example.com

What to observe: hop count, RTTs for each hop, any * * * (timeouts), and final destination.

Lab 2 — Using TCP when ICMP blocked

sudo traceroute -T -p 443 example.com
# or
tcptraceroute example.com 443

Why: many firewalls allow TCP port 443 (HTTPS) while blocking ICMP. TCP probes reveal real forwarding path.

Lab 3 — Continuous monitoring with mtr

mtr -r -c 200 example.com > live_mtr.txt

Interpretation: look for increasing loss% or sudden RTT spikes at a specific hop → likely issue.

Lab 4 — Checking load-balancing artifacts with Paris-traceroute

paris-traceroute example.com

Why: classic traceroute can show alternating hops due to per-flow load balancing (false negatives/positives).

Lab 5 — IPv6 paths

traceroute6 ipv6.google.com
# or on some systems
traceroute -6 ipv6.google.com

IPv6 uses similar principles but different packet types (ICMPv6).

5. How to Interpret Output (practical tips)

  • RTT pattern: gradual increase is normal. Sudden large jump at hop N indicates latency introduced at or after that hop.

  • Persistent packet loss at hop X but not after: usually not a problem — some routers deprioritize TTL-exceeded replies; check subsequent hops.

  • Loss that begins at a hop and persists to destination: likely real packet loss on that segment.

  • * * * timeouts: could be firewalling of probe types, router configured not to respond to TTL-expired.

  • Asymmetric routing: different return path can show different latencies — traceroute only shows forward path.

  • Multiple IPs at same hop: load balancing — use Paris-traceroute to detect and handle it.

  • Reverse DNS names: sometimes reveal location or provider (e.g., core-1.nyc1.isp.net) — useful for mapping.

6. Common Troubleshooting Scenarios

  • ICMP blocked: use TCP traceroute to port 80/443.

  • App-level connectivity issues but traceroute OK: check firewall rules, ACLs, or application logs.

  • High latency to a specific ISP hop: contact ISP support with hop IP and timestamps.

  • MPLS / provider-level hops showing opaque addresses: use service-provider support, correlate with BGP/WHOIS.

7. Security & Ethical Considerations

  • Traceroute itself is low-risk but can be noisy. Avoid high-frequency continuous probing without permission.

  • Some networks log traceroute probes — during a penetration test include it in scope.

  • Respect privacy and legal boundaries; use these tools strictly for diagnostics or permitted reconnaissance.

8. Best Practices for Network Auditors

  • Use multiple probe types (ICMP, UDP, TCP) to verify real behavior behind firewalls.

  • Combine traceroute output with ping, mtr, and Wireshark captures for complete picture.

  • Save outputs (-r for mtr, redirect traceroute output) with timestamps for reporting.

  • When assessing performance, run tests at different times to capture transient congestion.

9. CLI Cheat Sheet (quick commands)

traceroute example.com
sudo traceroute -T -p 443 example.com
mtr -r -c 100 example.com
tcptraceroute example.com 22
paris-traceroute example.com
tracepath example.com
traceroute -6 ipv6.google.com
tracert example.com   # Windows

10. FAQs

Q: Why does traceroute show different hops at different times?
A: Due to load balancing, routing changes, or probe filtering. Use Paris-traceroute to get consistent flows.

Q: Does traceroute measure the return path?
A: No — it measures path from you to destination; return path may be different.

Q: When should I use tcptraceroute?
A: When ICMP/UDP probes are blocked or when you need to test connectivity to a specific TCP port (e.g., 443).

Q: Is traceroute safe to run?
A: Yes for benign use, but abusive/high-frequency scanning can trigger alerts or be considered hostile.

11. Conclusion

Traceroute and its variants are indispensable for network troubleshooting and reconnaissance in ethical hacking. Choosing the right tool (ICMP vs UDP vs TCP), understanding load-balancing effects, and interpreting hop-by-hop RTT/loss will make your diagnostics accurate. Practice the labs in controlled environments and combine traceroute with other tools (mtr, Wireshark, ping) for robust network auditing.