How to Run a Traceroute on Windows, Mac and Linux (and How to Read It)

When a site is slow or unreachable, ping tells you that something is wrong. Traceroute tells you where. It lists every router between you and the destination, with the time each one took to answer, so you can see whether the delay starts on your own network, at your ISP, or somewhere near the server.

This guide covers the traceroute command on all three major operating systems, the options worth knowing, and how to read the output without jumping to the wrong conclusion.

How traceroute works

Every IP packet carries a Time To Live (TTL) value. Each router that forwards the packet lowers it by one, and when it reaches zero the router discards the packet and sends back an “ICMP Time Exceeded” message.

Traceroute uses that on purpose. It sends packets with a TTL of 1, then 2, then 3 and so on. Each router along the path reveals itself by replying when the TTL runs out. By default, it sends three probes per hop, which is why you see three times on each line.

Traceroute on Windows: tracert

Open Command Prompt or PowerShell and run:

tracert example.com

Useful options:

• -d skips reverse DNS lookups. Much faster, and often the first thing to add.
• -h 40 raises the maximum hops from the default 30.
• -w 2000 sets the timeout per reply in milliseconds.
• -4 or -6 forces IPv4 or IPv6.

Windows tracert uses ICMP echo requests. For packet loss statistics per hop, Windows also includes pathping, which runs a traceroute and then samples each hop for a few minutes.

Traceroute on macOS

Open Terminal and run:

traceroute example.com

Useful options:

• -n skips DNS lookups.
• -I uses ICMP instead of the default UDP probes. Try it when the UDP version shows only asterisks.
• -m 40 sets the maximum hops.
• traceroute6 traces over IPv6.

Older macOS versions had a graphical Network Utility app with a traceroute tab. It’s gone from recent releases, so Terminal is the way now.

Traceroute on Linux

Many minimal distributions don’t ship traceroute by default. Install it first:

sudo apt install traceroute      # Debian, Ubuntu
sudo dnf install traceroute      # Fedora, RHEL, Rocky

Then:

traceroute example.com

Linux traceroute has the most options:

• -n skips DNS lookups.
• -I uses ICMP (needs root).
• -T -p 443 uses TCP SYN packets to port 443 (needs root). This is the most useful option when firewalls drop UDP and ICMP, because traffic looks like a normal HTTPS connection.
• tracepath is a simpler alternative that doesn’t need root.
• mtr combines ping and traceroute into a live view with loss and latency per hop. If you troubleshoot networks regularly, install it.

Quick reference

Task	Windows	macOS	Linux
Basic trace	tracert host	traceroute host	traceroute host
No DNS lookups	tracert -d host	traceroute -n host	traceroute -n host
Use ICMP	Default	traceroute -I host	sudo traceroute -I host
Use TCP to a port	Not built in	Not built in	sudo traceroute -T -p 443 host
Loss per hop	pathping host	Install mtr	mtr host
IPv6	tracert -6 host	traceroute6 host	traceroute -6 host

How to read the output

Here’s a typical (shortened) result:

 1  192.168.1.1        1.2 ms   0.9 ms   1.1 ms
 2  10.20.0.1          8.4 ms   7.9 ms   8.2 ms
 3  core1.isp.net     12.1 ms  11.8 ms  12.4 ms
 4  * * *
 5  ix.fra.example    24.0 ms  23.7 ms  24.2 ms
 6  edge.ams.example  28.1 ms 120.4 ms  27.9 ms
 7  example.com       28.6 ms  28.3 ms  28.9 ms

Rules of thumb:

• Hop 1 is your router. If it’s slow or missing, the problem is local: Wi-Fi, cabling or the router itself.
• Asterisks (* * *) aren’t automatically a problem. Many routers are configured not to answer traceroute probes. If later hops answer normally, ignore it.
• A spike at one middle hop that doesn’t carry on is usually harmless. Routers treat replying to traceroute as a low priority. Hop 6’s 120 ms above is noise, because hop 7 is fast again.
• Latency that jumps and stays high from one hop onward is real. That’s where the delay starts.
• Big jumps can be geography, not a fault. Crossing an ocean adds tens of milliseconds by physics alone.
• Timeouts at the very end often mean the destination’s firewall blocks probes, not that it’s down. Try -T -p 443 on Linux.

Why you should also trace from outside

A traceroute from your laptop only shows your path. Internet routing is often asymmetric: traffic from the server back to you can take a completely different route. And when a user in another region reports problems, your own trace tells you nothing about their path.

That’s where running a traceroute online helps. A traceroute online tool runs the trace from a server elsewhere on the internet towards your host and shows every hop with its round-trip time. Use it to:

• Check how your server looks from a different network and region.
• Get a second opinion before blaming your own ISP.
• Share a clean, independent result with your host’s support team.

Tips for useful results

1. Run it more than once. A single trace can catch a momentary blip.
2. Trace in both directions where you can: from client to server and from the server back.
3. Use mtr or pathping for loss. Traceroute shows the path. These show which hop drops packets over time.
4. Add -n or -d when the trace is slow. Reverse DNS is often what you’re waiting on.

Traceroute won’t fix the network, but it turns “the internet is slow” into “the delay starts at hop 5, inside the transit provider”, and that’s a problem someone can actually solve.