MAN page from Trustix traceroute-1.4a5-19tr.i586.rpm


Section: Maintenance Commands (8)
Updated: 22 April 1997


traceroute - print the route packets take to network host 


traceroute[-dFInrvx] [-ffirst_ttl] [-ggateway] [-iiface]

        [-mmax_ttl] [-pport] [-qnqueries]

        [-ssrc_addr] [-ttos] [-wwaittime]



The Internet is a large and complex aggregation ofnetwork hardware, connected together by gateways.Tracking the route one's packets follow (or finding the miscreantgateway that's discarding your packets) can be difficult.Tracerouteutilizes the IP protocol `time to live' field and attempts to elicit anICMP TIME_EXCEEDED response from each gateway along the path to somehost.

The only mandatory parameter is the destination host name or IP number.The default probe datagram length is 40 bytes, but this may be increasedby specifying a packet length (in bytes) after the destination hostname.

Other options are:

Set the initial time-to-live used in the first outgoing probe packet.
Set the "don't fragment" bit.
Enable socket level debugging.
Specify a loose source route gateway (8 maximum).
Specify a network interface to obtain the source IP address foroutgoing probe packets. This is normally only useful on a multi-homedhost. (See the-sflag for another way to do this.)
Use ICMP ECHO instead of UDP datagrams.
Set the max time-to-live (max number of hops) used in outgoing probepackets. The default is 30 hops (the same default used for TCPconnections).
Print hop addresses numerically rather than symbolically and numerically(saves a nameserver address-to-name lookup for each gateway found on thepath).
Set the base UDP port number used in probes (default is 33434).Traceroute hopes that nothing is listening on UDP portsbasetobase + nhops - 1at the destination host (so an ICMP PORT_UNREACHABLE message willbe returned to terminate the route tracing). If something islistening on a port in the default range, this option can be usedto pick an unused port range.
Bypass the normal routing tables and send directly to a host on an attachednetwork.If the host is not on a directly-attached network,an error is returned.This option can be used to ping a local host through an interfacethat has no route through it (e.g., after the interface was dropped byrouted(8C)).
Use the following IP address (which usually is given as an IP number, nota hostname) as the source address in outgoing probe packets. Onmulti-homed hosts (those with more than one IPaddress), this option can be used toforce the source address to be something other than the IP addressof the interface the probe packet is sent on. If the IP addressis not one of this machine's interface addresses, an error isreturned and nothing is sent. (See the-iflag for another way to do this.)
Set thetype-of-servicein probe packets to the following value (default zero). The value must bea decimal integer in the range 0 to 255. This option can be used tosee if different types-of-service result in different paths. (If youare not running 4.4bsd, this may be academic since the normal networkservices like telnet and ftp don't let you control the TOS).Not all values of TOS are legal ormeaningful - see the IP spec for definitions. Useful values areprobably`-t16'(low delay) and`-t8'(high throughput).
Verbose output. Received ICMP packets other than TIME_EXCEEDED andUNREACHABLEs are listed.
Set the time (in seconds) to wait for a response to a probe (default 5sec.).
Toggle checksums. Normally, this prevents traceroute from calculatingchecksums. In some cases, the operating system can overwrite parts ofthe outgoing packet but not recalculate the checksum (so in some casesthe default is to not calculate checksums and using-xcauses them to be calcualted). Note that checksums are usually requiredfor the last hop when using ICMP ECHO probes(-I).

This program attempts to trace the route an IP packet would follow to someinternet host by launching UDP probepackets with a small ttl (time to live) then listening for anICMP "time exceeded" reply from a gateway. We start our probeswith a ttl of one and increase by one until we get an ICMP "portunreachable" (which means we got to "host") or hit a max (whichdefaults to 30 hops & can be changed with the-mflag). Threeprobes (change with-qflag) are sent at each ttl setting and aline is printed showing the ttl, address of the gateway andround trip time of each probe. If the probe answers come fromdifferent gateways, the address of each responding system willbe printed. If there is no response within a 5 sec. timeoutinterval (changed with the-wflag), a "*" is printed for thatprobe.

We don't want the destinationhost to process the UDP probe packets so the destination port is set to anunlikely value (if some clod on the destination is using thatvalue, it can be changed with the-pflag).

A sample use and output might be:

[yak 71]% traceroute to (, 30 hops max, 38 byte packet 1 (  19 ms  19 ms  0 ms 2  lilac-dmc.Berkeley.EDU (  39 ms  39 ms  19 ms 3  lilac-dmc.Berkeley.EDU (  39 ms  39 ms  19 ms 4  ccngw-ner-cc.Berkeley.EDU (  39 ms  40 ms  39 ms 5  ccn-nerif22.Berkeley.EDU (  39 ms  39 ms  39 ms 6 (  40 ms  59 ms  59 ms 7 (  59 ms  59 ms  59 ms 8 (  99 ms  99 ms  80 ms 9 (  139 ms  239 ms  319 ms10 (  220 ms  199 ms  199 ms11 (  239 ms  239 ms  239 ms

Note that lines 2 & 3 are the same. This is due to a buggykernel on the 2nd hop system - - that forwardspackets with a zero ttl (a bug in the distributed versionof 4.3BSD). Note that you have to guess what paththe packets are taking cross-country since the NSFNet (129.140)doesn't supply address-to-name translations for its NSSes.

A more interesting example is:

[yak 72]% traceroute to (, 30 hops max 1 (  0 ms  0 ms  0 ms 2  lilac-dmc.Berkeley.EDU (  19 ms  19 ms  19 ms 3  lilac-dmc.Berkeley.EDU (  39 ms  19 ms  19 ms 4  ccngw-ner-cc.Berkeley.EDU (  19 ms  39 ms  39 ms 5  ccn-nerif22.Berkeley.EDU (  20 ms  39 ms  39 ms 6 (  59 ms  119 ms  39 ms 7 (  59 ms  59 ms  39 ms 8 (  80 ms  79 ms  99 ms 9 (  139 ms  139 ms  159 ms10 (  199 ms  180 ms  300 ms11 (  300 ms  239 ms  239 ms12  * * *13 (  259 ms  499 ms  279 ms14  * * *15  * * *16  * * *17  * * *18  ALLSPICE.LCS.MIT.EDU (  339 ms  279 ms  279 ms

Note that the gateways 12, 14, 15, 16 & 17 hops awayeither don't send ICMP "time exceeded" messages or send themwith a ttl too small to reach us. 14 - 17 are running theMIT C Gateway code that doesn't send "time exceeded"s. Godonly knows what's going on with 12.

The silent gateway 12 in the above may be the result of a bug inthe 4.[23]BSD network code (and its derivatives): 4.x (x <= 3)sends an unreachable message using whatever ttl remains in theoriginal datagram. Since, for gateways, the remaining ttl iszero, the ICMP "time exceeded" is guaranteed to not make it backto us. The behavior of this bug is slightly more interestingwhen it appears on the destination system:

 1 (  0 ms  0 ms  0 ms 2  lilac-dmc.Berkeley.EDU (  39 ms  19 ms  39 ms 3  lilac-dmc.Berkeley.EDU (  19 ms  39 ms  19 ms 4  ccngw-ner-cc.Berkeley.EDU (  39 ms  40 ms  19 ms 5  ccn-nerif35.Berkeley.EDU (  39 ms  39 ms  39 ms 6  csgw.Berkeley.EDU (  39 ms  59 ms  39 ms 7  * * * 8  * * * 9  * * *10  * * *11  * * *12  * * *13  rip.Berkeley.EDU (  59 ms !  39 ms !  39 ms !

Notice that there are 12 "gateways" (13 is the finaldestination) and exactly the last half of them are "missing".What's really happening is that rip (a Sun-3 running Sun OS3.5)is using the ttl from our arriving datagram as the ttl in itsICMP reply. So, the reply will time out on the return path(with no notice sent to anyone since ICMP's aren't sent forICMP's) until we probe with a ttl that's at least twice the pathlength. I.e., rip is really only 7 hops away. A reply thatreturns with a ttl of 1 is a clue this problem exists.Traceroute prints a "!" after the time if the ttl is <= 1.Since vendors ship a lot of obsolete (DEC's Ultrix, Sun 3.x) ornon-standard (HPUX) software, expect to see this problemfrequently and/or take care picking the target host of yourprobes.

Other possible annotations after the time are!H,!N,or!P(got a host, network or protocol unreachable, respectively),!Sor!F(source route failed or fragmentation needed - neither of these shouldever occur and the associated gateway is busted if you see one),!X(communication administratively prohibited), or!<N>(ICMP unreachable code N).If almost all the probes result in some kind of unreachable, traceroutewill give up and exit.

This program is intended for use in network testing, measurementand management.It should be used primarily for manual fault isolation.Because of the load it could impose on the network, it is unwise to usetracerouteduring normal operations or from automated scripts. 


pathchar(8), netstat(1), ping(8) 


Implemented by Van Jacobson from a suggestion by Steve Deering. Debuggedby a cast of thousands with particularly cogent suggestions or fixes fromC. Philip Wood, Tim Seaver and Ken Adelman.

The current version is available via anonymous ftp:


Please send bug reports to




This document was created byman2html,using the manual pages.