Understanding Hops and Traceroute

When you connect to a website, your data doesn't travel directly. It hops from router to router, each one passing your packets closer to the destination. Understanding these hops—and how traceroute reveals them—is fundamental to diagnosing network problems and seeing the Internet's hidden structure.

What Is a Hop?

A hop is a single step in a packet's journey. Each router your data passes through counts as one hop.

A request to a server across the Internet might traverse:

1. Your home router
2. Your ISP's local router
3. Your ISP's regional router
4. An Internet backbone router
5. The destination ISP's router
6. The destination server's network
7. The destination server itself

Seven hops. Seven handoffs. The total number between you and a destination is called the hop count.

Why Packets Take Multiple Hops

The Internet is a network of networks. No single organization owns the path from your laptop to a server in Tokyo. Your packets must cross organizational boundaries—ISPs, backbone providers, cloud networks—each with their own routers.

This architecture creates redundancy. If one router fails, traffic reroutes through alternative paths. The Internet routes around damage because multiple paths exist.

The TTL Trick

Here's the problem traceroute solves: you can't just ask routers to identify themselves. They're busy forwarding packets, not answering questions.

The solution exploits a field in every IP packet header called TTL—Time To Live. Despite the name, TTL doesn't measure time. It counts hops. Every router that handles a packet decrements TTL by 1. When TTL hits zero, the router destroys the packet and sends back an error message: "Time Exceeded."

TTL exists to prevent packets from circulating forever if routing loops occur. But traceroute turns this safety mechanism into a mapping tool.

How it works:

Traceroute sends a packet with TTL=1. The first router decrements it to zero, destroys the packet, and reports back. Now you know the first hop's IP address.

Traceroute sends a packet with TTL=2. It survives the first router, dies at the second. The second router reports back. Now you know hop two.

This continues—TTL=3, TTL=4, TTL=5—until a packet finally reaches the destination. The destination responds differently (not "Time Exceeded" but "I'm here"), and the trace is complete.

Traceroute maps the Internet by sending packets designed to die at specific distances, then listening for the death announcements.

Reading the Output

A traceroute looks like this:

traceroute to example.com (93.184.216.34), 30 hops max
 1  192.168.1.1 (192.168.1.1)  2.3 ms  1.9 ms  2.1 ms
 2  10.0.0.1 (10.0.0.1)  12.5 ms  11.2 ms  13.6 ms
 3  core-router.isp.net (203.0.113.1)  15.2 ms  15.0 ms  16.1 ms
 4  border-router.isp.net (203.0.113.50)  18.5 ms  17.2 ms  19.6 ms
 5  peer-exchange.net (198.51.100.1)  25.1 ms  24.6 ms  26.2 ms
 6  dest-network.example.com (93.184.216.1)  28.5 ms  27.1 ms  29.2 ms
 7  example.com (93.184.216.34)  30.2 ms  29.6 ms  31.1 ms

Each line is one hop:

• Hop number: The position in the path
• Hostname and IP: The router's identity (hostname via reverse DNS, if available)
• Three timing values: Round-trip time in milliseconds (traceroute sends three probes per hop)

What the Patterns Mean

Asterisks ( * )

No response. The router didn't reply. This is often normal—many routers silently drop traceroute packets for security while still forwarding regular traffic. Your data is probably still getting through; you just can't see that hop.

 8  * * *

Latency jumps

Sudden increases reveal long-distance links:

 4  local-router (10.0.0.1)  15 ms  14 ms  16 ms
 5  overseas-router (198.51.100.1)  185 ms  183 ms  187 ms

That jump from 15ms to 185ms? An ocean. Undersea cables add latency that physics can't eliminate. Light in fiber travels at about 200,000 km/s, and oceans are wide.

Geographic clues

Router hostnames often contain location codes—city abbreviations, airport codes. "ord" is Chicago O'Hare, "lax" is Los Angeles, "ams" is Amsterdam. You can trace your packet's geographic journey.

What Traceroute Is Good For

Finding where connections break: If packets stop at hop 5, the problem is at or beyond that router.

Identifying bottlenecks: One hop showing 200ms while others show 20ms reveals where slowness originates.

Understanding your path: You see which networks your ISP peers with, which backbone providers carry your traffic, how your packets actually reach their destination.

Verifying redundancy: Run traceroute multiple times. Different paths indicate redundant routes.

What Traceroute Can't Tell You

The return path: Packets coming back may take a different route. Traceroute only maps the outbound journey.

Filtered hops: Routers that block ICMP create gaps. Your packets traverse them; you just can't see them.

Load-balanced paths: When multiple paths exist, each traceroute probe might take a different route, creating inconsistent results.

Precise latency: Network conditions fluctuate. The timing values are snapshots, not guarantees.

Variations

TCP Traceroute: Uses TCP instead of ICMP, bypassing firewalls that block ICMP.

MTR (My Traceroute): Combines traceroute with continuous ping, showing statistics over time rather than a single snapshot.

Paris Traceroute: Crafts packets to ensure consistent routing through load balancers.

Key Takeaways

Every packet carries a self-destruct timer (TTL) that decrements at each router. Traceroute exploits this by sending packets designed to die at specific distances, mapping the Internet hop by hop through error messages. When you run traceroute, you're seeing the invisible infrastructure—the routers, the cables, the organizational boundaries your data crosses to reach anywhere on Earth.