Reading traceroute and mtr like a pro

Reading Traceroute and mtr Like a Pro

Understanding the output of traceroute and mtr can help you diagnose network problems efficiently. These tools provide insight into the path packets take from your device to their destination, including latency per hop.

How They Work Under the Hood

Both traceroute and mtr use the Internet Control Message Protocol (ICMP) or User Datagram Protocol (UDP) to send packets with increasing Time-to-Live (TTL) values. Each router that decrements the TTL to zero sends back an "ICMP time exceeded" message, revealing its identity in the path.

• Traceroute: Sends a single pass of probes and shows the path taken by packets.
• mtr: Continuously performs traceroutes and provides additional statistics like packet loss per hop. It is generally preferred for diagnosing issues due to its comprehensive output.

Reading a Normal Trace

A typical traceroute or mtr output can be interpreted as follows:

1. Hop 1: Your gateway (usually 1-5ms if wired).
2. First few hops: Routers within your ISP.
3. Middle hops: Internet backbone routers, with latency increasing by about 1ms per 100km round trip.
4. Final hop: The destination.

A significant jump in latency between hops often indicates a long-distance link or a slow connection point (e.g., an ocean crossing).

Rules to Avoid Misinterpretation

Here are some key rules that help avoid drawing incorrect conclusions:

1. High Latency at One Hop Only, While Later Hops Look Fine: This is usually due to the router deprioritizing responses for control plane purposes rather than a network issue. Routers forward packets quickly but may reply to probes lazily.

2. Real Problems Start and Persist: If you see loss starting from hop 7 and continuing through the final hop, there's likely an actual problem at or after hop 7.

3. Final Hop Numbers Matter Most: The latency and packet loss on the last hop are what the user experiences. Intermediate issues that don't affect the final destination can be ignored.

4. Asymmetric Paths: The return route may differ from the forward path, so a "clean" trace with loss only in one direction could indicate a problem on the return path. Always test from both ends when possible.

5. Loss Only on the Final Hop: This often indicates rate-limiting at the destination rather than packet loss.

Practical Flow for "The Internet is Slow"

1. Run mtr to 1.1.1.1 (or another public DNS server) for 100 cycles.
   • Loss at Hops 1-2: Indicates issues with your equipment or Wi-Fi.
   • Loss from Mid-ISP Hops Onward: Suggests problems within the ISP's network, warranting an ISP ticket.
   • Clean mtr but Slow App: The issue is likely higher up in the stack (e.g., application-level).

By following these guidelines, you can interpret traceroute and mtr outputs effectively to diagnose and resolve networking issues.