Vol. I · No. 46The command line sectionSat, 10 Oct 2026
Linux · reachability

mtr

traceroute, continuously

mtr traces the route like traceroute, then keeps probing every hop and updates the figures as it goes. One screen shows where on the path packets are being lost or delayed, which a single traceroute cannot.

Loss that continues to the final hop is real. Loss at one middle hop only usually is not.

Shows
Each hop, live
loss and latency
For a report
mtr -rw HOST
runs, then prints a table
Fewer lookups
-n
addresses only
Quit
q
in the live view

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashmtr-tiny
$ mtr -rwn -c 10 198.51.100.20
1HOST: netflow Loss% Snt Last Avg Best Wrst StDev
2 1.|-- 192.168.1.1 0.0% 10 0.6 0.7 0.5 1.1 0.2
2.|-- 192.0.2.1 0.0% 10 4.8 5.1 4.6 6.3 0.5
3 3.|-- 203.0.113.9 40.0% 10 12.4 12.9 12.1 14.0 0.6
4 4.|-- 198.51.100.20 0.0% 10 13.0 13.2 12.8 14.1 0.4
Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range
Reading the output

What the numbered lines are telling you

1
The columns

Percentage lost, probes sent, then the last, average, best and worst round-trip time in milliseconds, and how much it varies.

2
The first hop is your router

Under a millisecond and no loss: the local network is fine.

3
Loss at one hop only

Hop 3 dropped 40% of the probes sent to it, but the hop after it shows none. The router is simply limiting how often it replies; traffic through it is unaffected.

4
The destination

No loss and a steady 13 ms. The path is healthy end to end, whatever hop 3 looked like.

Switches

A switch changes how the command behaves. These are the ones used day to day; man mtr lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-r
Report mode: run, then print a table and exit.
-w
Wide report: do not cut host names short.
-n
Numeric: no name lookups.
-c NUM
Send NUM probes to each hop.
-T
Use TCP probes. -u uses UDP.
-P PORT
The destination port for TCP or UDP probes.
-b
Show both names and addresses.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

mtr 198.51.100.20

The live view, updating until you press q.

mtr -T -P 443 example.com

Probes with TCP to port 443, as real web traffic would travel.

mtr -u example.com

Probes with UDP instead of ICMP.

mtr -rw -c 100 example.com > path.txt

Saves a 100-probe report to send to a network provider.

In cybersecurity

A path trace shows whose networks your traffic crosses.

Read loss correctly

Routers deliberately limit replies to probes. Misreading that as a fault leads to blaming the wrong network. Trust the last hop.

Unexpected paths

Traffic to a nearby service that suddenly crosses another country may be a routing change — or a route hijack. A saved baseline makes the difference visible.

Firewalls change the picture

Many networks drop ICMP. Probing with TCP to the service’s real port shows the path that the actual traffic takes.

Protocols it shows

ICMPIPv4UDPTCP

Read alongside

tracerouteReveals each router between this host and a destination by sending packets whose TTL expires one hop further each time.pingSends ICMP echo requests to a host and times the replies — the first test of whether the other end is reachable at all.