Diagnosing network connectivity failures or sudden latency spikes requires visibility into the physical and logical path your packets traverse across the internet. In Windows 11, the native tracert (Trace Route) command-line utility maps the exact intermediate hops between your workstation and a destination server, reporting round-trip travel times for every intermediate router along the way.
While modern graphical utilities display aggregate bandwidth or ping latency, they rarely pinpoint which specific hop is responsible for packet loss or bottlenecking. By running tracert in Windows Terminal or Command Prompt, you can quickly determine whether connectivity degradation originates inside your local gateway, at an internet service provider (ISP) interchange, or within the destination host’s datacentre network.
How the tracert Utility Operates in Windows 11
The tracert command operates by manipulating the Time to Live (TTL) field inside Internet Control Message Protocol (ICMP) echo request packets:
- Hop 1 (TTL = 1): Windows dispatches three ICMP packets with a TTL of 1. When the first router (usually your local router or default gateway) receives the packet, it decrements the TTL to 0. Since the packet cannot travel further, the router discards it and returns an
ICMP Time Exceededmessage back to your computer. - Hop 2 (TTL = 2): Windows increments the TTL to 2. The first router forwards the packet to the next hop, which decrements the TTL to 0 and returns its own
ICMP Time Exceededresponse. - Incremental Trace: This procedure repeats systematically, incrementing the TTL by 1 at each stage until either the destination host responds with an
ICMP Echo Replyor the maximum hop threshold (defaulting to 30) is reached.
For each hop, tracert sends three separate probe packets and records the round-trip latency in milliseconds (ms), enabling you to evaluate path stability and identify erratic jitter.
How to Run a Basic Route Trace in Windows 11
You can execute tracert using standard user privileges in either Windows Terminal, Command Prompt, or PowerShell without requiring administrative elevation.
- Press Win + R to launch the Run dialogue box.
- Type
cmdorwtand press Enter to launch your terminal. - Type the following command followed by an IP address or fully qualified domain name (FQDN):
tracert 1.1.1.1 - Press Enter to initiate the trace.
To trace the path to a website domain rather than a static IP address, pass the hostname directly:
tracert google.comWindows will first resolve the domain name through your configured DNS servers, print the resolved IP address in square brackets, and proceed through the hop sequence.
Key tracert Syntax and Useful Command Options
Executing tracert with default settings queries DNS reverse lookups for every single hop, which often slows down trace completion. You can combine multiple optional switches to tailor the diagnostic output.
| Parameter | Function Description | Practical Application |
|---|---|---|
-d |
Prevents DNS resolution of router IP addresses. | Accelerates the trace substantially by suppressing reverse PTR queries. |
-h <max_hops> |
Specifies the maximum number of hops to search (default is 30). | Restricts long traces when diagnosing near-premises routing issues. |
-w <timeout> |
Adjusts the timeout threshold in milliseconds for each reply (default is 4000 ms). | Prevents lengthy 4-second stalls on firewalled routers. |
-4 |
Forces the utility to use IPv4 routing exclusively. | Ensures traces do not default to IPv6 when diagnosing legacy IPv4 paths. |
-6 |
Forces the utility to use IPv6 routing exclusively. | Audits native IPv6 peering routes and transitional gateways. |
Accelerating Traces with the -d Parameter
When you only require raw IP addresses and latency figures, avoid waiting for public PTR records by appending -d:
tracert -d 8.8.8.8Shortening Wait Times with -w
If an intermediate router drops ICMP probes, Windows waits 4,000 milliseconds (4 seconds) per packet, totaling 12 seconds per silent hop. You can reduce this waiting interval to 1,000 milliseconds using -w 1000:
tracert -d -w 1000 example.comInterpreting tracert Output and Common Network Patterns
A typical trace report displays the hop count, three latency columns, and the identifying IP address or hostname:
Tracing route to one.one.one.one [1.1.1.1]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.1.1
2 8 ms 7 ms 7 ms 10.240.0.1
3 11 ms 10 ms 12 ms 195.66.224.21
4 12 ms 11 ms 11 ms 1.1.1.1
Trace complete.Analysing Output Columns
- Hop Index (Column 1): Represents the sequential step along the routing path. Hop 1 is almost universally your local router, Wi-Fi mesh point, or corporate switch.
- Probe Times (Columns 2, 3, and 4): The round-trip time in milliseconds for the three separate ICMP probe packets sent to that router.
- Target Identification (Column 5): The router’s hostname and IP address. If DNS resolution was suppressed, only the IP address appears.
Diagnosing ‘Request Timed Out’ Lines
Seeing asterisks (* * * Request timed out) does not automatically signify a network failure. Many enterprise border routers and cloud load balancers intentionally deprioritise or drop ICMP TTL Exceeded packets to protect routing engines from denial-of-service traffic.
- Isolated Timeout: If Hop 5 displays
Request timed out, but Hop 6, 7, and 8 respond promptly with normal latency, the connection is intact. The router at Hop 5 simply ignores ICMP probes while continuing to forward transit traffic seamlessly. - Persistent Timeouts to the End: If timeouts begin at Hop 6 and persist continuously through Hop 30, packets are either blocked by a perimeter firewall or discarded due to a routing loop or severed carrier link.
Spotting High Latency and Jitter Bottlenecks
When latency increases dramatically at a specific hop and remains elevated for all subsequent hops, the latency originated at that transition. For example, if hops 1 through 4 register 10 ms, but hop 5 and all subsequent hops jump to 210 ms, the link between hop 4 and hop 5 represents the bottleneck (such as an overseas undersea cable or congested peering point).
Choosing Between tracert, pathping, and Test-NetConnection
Windows 11 includes several complementary command-line diagnostic utilities. Selecting the appropriate tool depends on whether you are verifying basic routes, statistical packet loss, or application-specific port reachability:
- tracert: Best for rapid, immediate route inspections across both local and internet paths.
- pathping: For exhaustive statistical packet loss analysis over several minutes, use the Windows 11 pathping command, which combines
tracertandpingfunctionality. - Test-NetConnection: When verifying whether a specific TCP port (such as 443 or 3389) is accepting connections, run the Test-NetConnection PowerShell cmdlet.