traceroute
which way the packet wenttraceroute sends probes with a TTL of 1, then 2, then 3. Each router that decrements the TTL to zero discards the probe and reports back with an ICMP time-exceeded message, and that reply gives away the router's address. The result is the forward path, one hop per line.
The TTL exists to kill packets caught in a loop — traceroute uses that safety mechanism as a flashlight.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
Three probes, three round-trip times. Sub-millisecond is what a healthy local link looks like.
From 0.4 ms to 3 ms: the packet left the building. The time is cumulative to that hop, not the cost of that hop alone.
It forwarded the probes — later hops answered — but sends no time-exceeded messages, or rate-limits them. Not a fault.
Its time should match what ping reports. If the trace ends in stars instead, the path or the target is dropping the probe type.
Switches
A switch changes how the command behaves. These are the ones used day to day; man traceroute lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-n- Numeric: show addresses only, do not look up host names. Much faster.
-I- Probe with ICMP echo requests instead of UDP.
-T- Probe with TCP SYN packets — gets through firewalls that drop the others.
-p PORT- The destination port to probe.
-m NUM- Give up after NUM hops. The default is 30.
-q NUM- Send NUM probes per hop instead of three.
-w SECS- Wait at most this long for each reply.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
traceroute -I 192.0.2.10Probes with ICMP echo instead of UDP, which more firewalls allow.
traceroute -T -p 443 192.0.2.10Probes with TCP SYNs to port 443 — follows the path real web traffic takes. Needs root.
tracepath 192.0.2.10A sibling tool that needs no privileges and reports the path MTU as it goes.
mtr -n 192.0.2.10Runs traceroute continuously and shows loss per hop — the better tool for an intermittent fault.
In cybersecurity
A trace is a map of somebody's network, drawn from outside. That makes it a standard step in reconnaissance, and a reason many routers stay quiet.
Router addresses and reverse names reveal providers, sites and internal numbering. Filter time-exceeded at the edge if that matters.
The hop where probes stop being answered is usually the filtering device, and the probe type that gets through shows its rules.
Loss that appears at a middle hop but not at the destination is just that router rate-limiting replies — not a real problem.
The return path is invisible here. A trace that looks clean one way can hide a fault in the other direction.
A path that suddenly crosses an unfamiliar network may be a routing leak or a BGP hijack. Compare it with a known-good trace.
Equal-cost paths mean successive probes can take different routes, so one line may show several addresses.