It sends probes with progressively larger IPv4 TTL or IPv6 Hop Limit values. Each expiry can elicit an ICMP Time Exceeded response identifying a responding hop, while a destination response indicates that the probe reached its target.
Implementations may use different probe protocols and report response round-trip times. The sequence is one observation, not an authoritative topology map: forwarding can be load-balanced or asymmetric, and routers may filter, rate-limit, or deprioritize replies.
Key points
Useful outputHop addresses, response times, timeouts, and destination or filtering responses can narrow the part of a path associated with a reachability or delay change.
InterpretationRepeat comparable tests and correlate them with routing, interface, latency, loss, and endpoint evidence. A silent hop can still forward later probes.
Safe operationProbe only destinations and networks for which testing authorization exists. Rate-limit and schedule testing, and follow site-specific safety-assessment and change-control requirements before active diagnostics in OT environments.
Important limitationTraceroute does not reveal every device, the return path, or necessarily the path used by other traffic. Results can expose infrastructure details and addresses, so collect, retain, and share them only for a defined purpose under applicable privacy and security rules.