Use traceroute to understand network latency

Traceroute exploits the TTL field in IP packets. It sends a packet with TTL=1, which the first router decrements to 0 and discards, returning an ICMP "Time Exceeded" message that reveals the router's IP. Then TTL=2 reaches the second router, and so on.

So each "hop" line is just the router that happened to decrement TTL to zero at that distance. The route is inferred — there is no protocol-level "give me the path" request.

The first hops are almost always your local router, then your ISP's aggregation, then their core. Later hops cross into transit providers, IXPs, CDN points of presence, and finally the destination network.

A whois on a router IP, or matching the hostname pattern, often tells you who owns each hop. `tier1.network` and `as-XXXX.peer` patterns are common.

Default traceroute on Linux/macOS uses UDP probes; Windows `tracert` uses ICMP. Many firewalls block UDP traceroute but allow ICMP, or vice versa — getting `* * *` everywhere often just means probe type is filtered, not that the network is down.

TCP traceroute sends SYN packets to a real port (typically 80 or 443). It routes more like real application traffic and often passes through firewalls that block ICMP/UDP traceroute. Use it when other methods give up.

Routers commonly rate-limit ICMP responses or refuse to send them at all. A `* * *` in the middle of the path, where subsequent hops respond normally, almost always means that one router is just not answering, not that traffic dies there.

You should worry when the timeouts persist for the rest of the path, when latency spikes from one hop to the next and stays elevated, or when the destination never responds at all.

Latency jumps usually happen at provider boundaries. Mapping each hop to its ASN reveals which network the slowdown belongs to. A 200ms jump inside one ASN is that network's problem; a jump across ASNs may be transit congestion or a long physical link.

Online tools like bgp.he.net or `whois` on the hop IP give the AS number. ipconf.me's JSON endpoint also returns ASN for any IP.

A single traceroute is one data point. Run the same destination from a home broadband, a mobile network, and a cloud VM in a different region. Consistent latency in the last 3-5 hops points to the destination side. Latency that only appears on one access network is local to that ISP or path.

For ongoing comparison, schedule traceroutes from a cheap VPS in each region of interest, log the results, and graph the per-hop latency over time.

MTR (My TraceRoute) is traceroute + ping in a loop. It runs the trace continuously and aggregates loss percentage and latency per hop, which is far more useful than a single snapshot.

When you see "intermittent slowness", MTR will show whether one specific hop is the problem (consistent loss at that hop) or the issue is end-to-end (loss only at the destination, all upstream hops clean).