traceroute
/ TRACE-route /
Suppose a parcel reaches a far city but you have no idea which sorting depots it passed through on the way. Traceroute is the trick that reveals each stop on a packet's journey, one hop at a time. When ping tells you a destination is slow or unreachable, ping cannot say where the trouble is — traceroute can, by mapping the actual sequence of routers between you and the destination and timing each one.
The clever part is how it forces routers to reveal themselves, by abusing the IP time-to-live (TTL) field. Every IP packet carries a TTL that each router decrements by one; when TTL hits zero, the router discards the packet and sends back an ICMP "time exceeded" message — and that message comes from the router itself, revealing its address. Traceroute exploits this on purpose: it sends a packet with TTL=1 (the first router replies), then TTL=2 (the second router replies), then TTL=3, and so on. Each round it learns the next router along the path and how long that round trip took, building the route hop by hop until packets finally reach the destination.
Read the output with care, because traceroute has real quirks. Each line shows the round-trip time to that hop, not the delay of that one link, so a single slow hop can be misleading — and the latency can legitimately jump and then settle again. Many routers de-prioritise the ICMP replies they generate, so a hop showing high RTT or asterisks (no reply) may be perfectly busy forwarding real traffic; it just answers traceroute slowly or not at all. The forward and return paths can also differ, and load balancers can send successive probes down different routes. Traceroute reveals the path superbly, but its per-hop timings are a hint, not a verdict.
Running "traceroute example.com" prints lines like: "1 192.168.1.1 1.0 ms", "2 10.20.0.1 8.3 ms", "3 * * *" (a hop that ignores ICMP), "4 72.14.x.x 22.5 ms", "5 example.com 23.1 ms". You can now see exactly where along the path the round-trip time jumps.
Traceroute maps the path hop by hop by stepping the IP TTL up one at a time and reading each router's "time exceeded" reply.
A hop showing high RTT or "* * *" is often NOT the problem: many routers de-prioritise or block the ICMP they themselves generate while forwarding real traffic fine. Per-hop times are a hint; the forward and return paths may also differ.