The Limitation of Ping and Traceroute
When a user complains that “the internet is slow,” network administrators traditionally reach for two legacy tools: ping and traceroute.
ping tells you if the destination is reachable, but it doesn’t tell you where the connection is dropping. traceroute shows you every single router (hop) between your computer and the destination, but it only runs once and then stops.
If a network bottleneck is intermittent (e.g., a router drops packets for exactly two seconds every minute), a standard traceroute will completely miss it.
To identify intermittent, deep-routing failures, network engineers use the legendary mtr (My Traceroute) command. It combines the continuous polling of ping with the path discovery of traceroute into a single, live, interactive dashboard.
1. Launching a Standard MTR Diagnosis
To diagnose a connection to a specific server (e.g., Google’s public DNS), simply run:
mtr 8.8.8.8Unlike standard traceroute, mtr takes over the entire terminal window. It instantly maps out all 10-15 routers between you and Google, and then it aggressively sends packets to every single router simultaneously, updating the statistics on your screen every second.
You will see a live table displaying:
- Loss%: The percentage of packets dropped by that specific router.
- Snt: The total number of packets sent.
- Last / Avg / Best / Wrst: The latency (ping time) to that specific router in milliseconds.
If the first 5 hops show 0% packet loss, but the 6th hop (an ISP router in Chicago) shows 40% packet loss, you have instantly pinpointed the exact physical location of the internet outage.
2. Bypassing ICMP Blocking with TCP Mode
There is a massive caveat to standard mtr. It relies on ICMP (Internet Control Message Protocol) packets. Many modern corporate firewalls and ISPs aggressively block ICMP packets to prevent ping floods.
If you run mtr and see 100% packet loss at the final destination, but you can successfully load the destination’s website in your browser, the firewall is blocking ICMP. You must force mtr to use TCP packets (which masquerade as standard web traffic) to bypass the firewall.
mtr --tcp --port 443 digitash.comBreaking down the flags:
--tcp: Switches the protocol from ICMP to TCP.--port 443: Forces the packets to target the HTTPS web port, which firewalls are forced to leave open.
This allows you to accurately map the route directly through hostile corporate firewalls.
3. Generating a Static Report for ISPs
The interactive dashboard is incredible for live troubleshooting, but if you need to open a support ticket with your Internet Service Provider, you cannot send them a screenshot. They require raw text data spanning a statistically significant timeframe.
You can force mtr to run invisibly in the background, send exactly 100 packets, and then output a pristine text report.
mtr --report --report-cycles 100 8.8.8.8 > /tmp/isp_report.txtBreaking down the flags:
--report: Disables the interactive UI and outputs a final, static text table.--report-cycles 100: Forces the tool to send exactly 100 packets to every single hop before generating the final averages.
You can attach the resulting isp_report.txt file directly to your support ticket, providing irrefutable mathematical proof of where their routing infrastructure is failing.
Conclusion
The mtr command is an absolute necessity for network troubleshooting. By fusing continuous ICMP polling with deep path discovery, it eliminates the guesswork of intermittent latency spikes, allowing engineers to visualize exactly which node on the global internet is dropping their packets.