Traceroute & MTR Testing: Interpreting Network Path Latency & Packet Loss

When troubleshooting high latency, routing loops, or packet dropouts between a client device and a remote server, network engineers rely on path diagnostic utilities: Traceroute (traceroute on Unix / tracert on Windows) and MTR (My TraceRoute). While ping tests confirm whether a destination is reachable, path diagnostic tools trace every intermediate router hop along the IP network path.

Direct Answer: Traceroute provides a single snapshot of every router hop along the network path by incrementing the IP packet's Time-To-Live (TTL) field. MTR (My TraceRoute) combines the hop discovery of traceroute with continuous ping statistical analysis over hundreds of cycles. When analyzing diagnostic outputs, packet loss on an intermediate hop is harmless if subsequent hops and the final destination show 0% packet loss; this indicates the router's ICMP control plane rate-limited probe responses while continuing to forward data packets normally.

1. How Traceroute Works: The IP TTL Mechanism

Traceroute does not use a special "path tracing" protocol. Instead, it leverages standard IP header fields and ICMP error reporting:

1. Hop 1 Probe: Traceroute sends a packet to the target IP with TTL = 1. The first router decrements TTL to 0, drops the packet, and returns an ICMP Time Exceeded (Type 11, Code 0) message to the sender. The sender logs the router's IP and measures round-trip latency.
2. Hop 2 Probe: Sender transmits a packet with TTL = 2. It passes the first router, hits the second router where TTL expires, and returns another ICMP Time Exceeded message.
3. Destination Reached: The process repeats (TTL = 3, 4, 5...) until the packet reaches the target host, which responds with an ICMP Echo Reply (or Port Unreachable for UDP probes).

Sender ──► TTL=1 ──► Router 1 (TTL=0) ──► Returns ICMP Time Exceeded (Hop 1 Recorded)
Sender ──► TTL=2 ──► Router 1 ──► Router 2 (TTL=0) ──► Returns ICMP Time Exceeded (Hop 2 Recorded)
Sender ──► TTL=N ──► Router 1 ──► Router 2 ... ──► Target Host ──► Returns ICMP Echo Reply (Path Complete)

To test latency and host responsiveness, engineers can run the Ping Test and inspect network stability using the Internet Stability Test.

2. Probing Protocol Variations: ICMP vs UDP vs TCP

Different diagnostic implementations use different IP payload protocols:

• Windows tracert (ICMP): Transmits ICMP Echo Request packets. Often blocked by corporate firewalls and cloud security groups.
• Linux / macOS traceroute (UDP): Transmits UDP packets to high-numbered ports (e.g., port 33434). Reaching the host triggers an ICMP Port Unreachable response.
• TCP Traceroute (tcptraceroute / traceroute -T): Transmits TCP SYN packets to standard web ports (e.g., port 80 or 443). Essential for tracing paths through firewalls that drop ICMP and UDP traffic.

3. Interpreting MTR Diagnostic Reports & Common Artifacts

An MTR output provides a real-time statistical table:

HOST: client.example.com         Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 192.168.1.1               0.0%   100    0.8   0.7   0.5   1.2   0.2
  2.|-- 10.0.0.1                  0.0%   100    8.4   9.1   7.8  14.2   1.1
  3.|-- 96.120.10.1              45.0%   100   12.1  13.4  11.2  45.0   5.2  <-- Control Plane Rate Limiting!
  4.|-- 68.86.90.1                0.0%   100   14.2  15.1  13.8  22.1   1.8
  5.|-- 142.250.190.46            0.0%   100   14.8  14.6  13.9  18.2   0.7  <-- Final Destination 0% Loss

Key Diagnostic Rules:

1. Control Plane ICMP Rate-Limiting (False Loss): On Hop 3 above, MTR reports 45% packet loss. However, Hops 4 and 5 show 0% loss. This proves that Hop 3 forwarded 100% of data traffic, but its CPU rate-limited generating ICMP Time Exceeded diagnostic responses. This is not real network degradation.
2. True Upstream Packet Loss: If packet loss begins on Hop 3 and persists across all subsequent hops (e.g., 20% loss on Hop 3, 20% on Hop 4, 20% on Hop 5), a genuine link degradation or congested peering interface exists at Hop 3.
3. Asymmetric Routing: Incoming data packets may take a completely different physical path back to your network than outgoing packets took, causing latency discrepancies between hops.

To test target server IP information and packet drop rates, developers can use the IP Address Lookup and Packet Loss Test.

4. Frequently Asked Questions (FAQs)

Why does traceroute sometimes show asterisks (* * *) for an intermediate hop?

Asterisks indicate the probe for that hop received no response within the timeout window. This commonly happens when a router is configured to deprioritize or rate-limit ICMP Time Exceeded generation (a CPU-load or security practice), not necessarily because the hop is unreachable — subsequent hops often still respond normally, proving the path continues to function.

Does traceroute show the actual path that return traffic takes back to my computer?

No. Traceroute only reveals the forward path from the sender to the destination. Internet routing is frequently asymmetric, meaning return traffic can travel through entirely different routers and Autonomous Systems, so traceroute cannot diagnose issues that occur only on the reverse path.

How many ping cycles should MTR run for a reliable diagnosis?

A short MTR run (10-20 cycles) can be skewed by transient network noise, especially at hops performing ICMP rate-limiting. Running MTR for at least 100 cycles over several minutes produces a statistically meaningful average, best/worst, and standard deviation column, making it far easier to distinguish genuine sustained packet loss from harmless control-plane rate-limiting artifacts.

References: IETF RFC 792 (Internet Control Message Protocol); IETF RFC 1393 (Traceroute Using an IP Option).