How to Use the traceroute Command to Trace Network Paths in Linux

When you try to connect to a remote server or a website and experience severe lag or a complete connection failure, the problem is rarely on your computer, and rarely on the destination server. Usually, the failure is occurring somewhere in the middle of the internet—perhaps at a congested router halfway across the country.

While the ping command can tell you if a server is online, it cannot tell you where a connection is failing. To map the exact path your data is taking across the internet, hop by hop, you must use the traceroute command in Linux.

Installing traceroute

Unlike ping, the traceroute utility is not always installed by default on minimal Linux distributions. If you receive a “command not found” error, you must install it.

On Ubuntu or Debian-based systems, run:

sudo apt install traceroute

How to Run a Basic Trace

Using the tool is incredibly simple. Just type the command followed by the domain name or IP address of your destination.

traceroute google.com

When you press Enter, the command will begin printing a numbered list. Each number represents a “hop”—a physical router that your data passed through on its journey to Google’s servers.

How to Read the Output

A typical line of output looks like this:

3 192.168.1.1 (192.168.1.1) 1.234 ms 1.189 ms 1.112 ms

• Hop Number (3): This is the third router in the chain. (Hop 1 is usually your home WiFi router).
• Hostname/IP: The identity of the router handling your data.
• Timestamps (ms): traceroute sends three separate data packets to each router to test the connection speed. These three numbers show how many milliseconds it took for the packet to reach the router and return.

Identifying the Problem

As the trace runs, you are looking for two specific warning signs:

1. High Latency: If hops 1 through 5 show response times of 15 ms, but hop 6 suddenly jumps to 450 ms, you have found a heavily congested or failing router. That specific node is slowing down your entire connection.
2. Asterisks (* * *): If a hop returns three asterisks instead of timestamps, it means the router dropped the packets or refused to respond. While some security-conscious routers intentionally block traceroute requests (meaning the connection is fine, it’s just hiding), multiple consecutive rows of asterisks usually indicate where your connection physically died.

By using traceroute, you can definitively prove whether a network issue is your ISP’s fault, or if the problem lies deeper within the internet backbone.