Investigator · Lesson 02

How can you inspect the path to a destination?

Traceroute sends probes with increasing hop limits to reveal possible intermediate routers and their response times. It helps locate where observations change, but a missing reply does not automatically mean that traffic stopped there.

Packet lifetime

TTL puts a limit on forwarding.

In an IPv4 packet, TTL (Time To Live) is a counter carried in the header. Each router decreases it before forwarding the packet. When the value reaches zero, the router discards the packet and may send an expiry message back to the sender.

This prevents a packet caught in a routing loop from circulating forever. Traceroute deliberately sends probes with small TTL values so one router at a time reaches zero and reveals an intermediate hop.

TTL is a loop-safety mechanism, not a clock.Its value measures forwarding hops rather than seconds. DNS records also have a TTL, but that separate value controls how long a resolver may keep an answer in its cache.

Reveal one hop at a time

A path is observed through controlled probes.

Traceroute varies the packet's hop limit, called TTL (Time To Live), so different routers may return an expiry message. The tool records the responding address and the measured delay for each step.

Different probes can take different paths. Routers may also rate-limit or ignore diagnostic replies while continuing to forward ordinary traffic.

A blank hop is an observation, not a verdict.A timeout may reflect filtering, rate limiting, or a return-path issue. Compare several probes and other signals before drawing a conclusion.

Interpret the evidence

A slow hop is not automatically the bottleneck.

Traceroute measures the time for a diagnostic reply to return from each hop. A router may answer those control messages slowly or rate-limit them while forwarding ordinary packets normally.

Look for a delay pattern that continues through later hops and reaches the destination. A high value at one intermediate hop that disappears on the next line is weaker evidence than a sustained increase. Compare repeated probes and application-level measurements before naming a bottleneck.

Read a traceroute as a set of clues.It shows how the probes were answered, not a complete record of every packet's physical path or the exact cause of end-to-end delay.

Build the model

Four traceroute clues

01

Hop limit

Controls how far a probe can travel before a router responds.

02

Hop address

Identifies the interface that returned a diagnostic response.

03

Probe time

Shows the measured round-trip delay for that probe.

04

Timeout

Shows that no diagnostic reply arrived within the wait window.

Mini investigation

Read a path sample

Select the observed hop and identify the strongest first conclusion.

TRACEHop 3 · 18 ms

A router at hop 3 returned a diagnostic response after 18 ms.

This confirms a responding hop in the observed probe path.

Knowledge check

Test your traceroute model

Answer eight questions. The answer order changes each time.

0 / 8