How Traceroute Actually Works

The Internet isn't a single wire; it's a network of interconnected routers, ISPs, and networks through which data packets travel to reach their destination. When you access a website, your request goes through a series of these routers before arriving at the server, and the response doesn't always follow the same path back. Each device along this invisible chain is owned by a different entity, and none of them are obligated to disclose their identity. If a page loads slowly, the issue could be at any point along this path.

A common method to identify where latency or packet loss occurs is by using a tool called traceroute. It's often recommended by tech support when a user experiences slow connections or packet drops. However, many people don't know how traceroute actually maps the path across these networks, as it relies on a clever manipulation of ICMP error messages and a field that wasn't initially intended for this purpose.

In computer networking, a packet is a small unit of data that needs to be transmitted. Routers, also known as hops, are devices that forward these packets step by step toward their final destination. Each packet contains an IP address, which functions like a postal address for devices on a network. The TTL, or Time To Live, is a counter within each packet that prevents infinite looping in case of routing errors.

ICMP, or Internet Control Message Protocol, is a companion protocol used by routers to send error messages back to the sender.

Traceroute exploits the TTL field's design flaw to map the path. It sends packets with an initial TTL of 1, which the first router will drop and send back an ICMP Time Exceeded message containing its IP address. This tells us the first hop. The process repeats, incrementing the TTL each time, until a packet reaches its destination and receives a normal reply.

Traceroute doesn't ask routers who they are; instead, it deliberately kills its own packets as it moves further away and reads the return address from the routed packet.

The packets used in traceroute have three key components: an outgoing probe, a raw socket for setting the TTL field and reading responses, and a timer to measure the response time. The probe can be a UDP packet to an improbable-open port, an ICMP Echo Request, or a TCP SYN packet. The raw socket is necessary to configure the TTL and read the ICMP responses.

The timer starts when the probe is sent and stops when the reply arrives, providing the RTT, or Round-Trip Time, for that particular hop. Most implementations send three probes per TTL to reduce noise caused by variations in queuing delay and load balancing.

However, the textbook explanation of traceroute doesn't always hold true in practice. ICMP messages can be blocked or rate-limited by routers and firewalls, leading to silent failures instead of error messages. This could mean the router exists but chose not to report the issue. Additionally, Large-scale networks like MPLS hide hops entirely, making the path appear different from what it truly is. Asymmetric routing can also cause discrepancies between the forward and return paths, leading to inaccurate RTT measurements.

Because traceroute relies on ICMP, it requires elevated privileges and access to raw sockets, making it challenging to implement in web browsers. Instead, a common approach is to use a backend that handles the probing while providing a frontend interface that displays the results. The frontend renders a partial, growing path, showing distinct states of timeout, still-probing, and resolved hops.