How to Install and Use traceroute on Ubuntu (UDP, ICMP and TCP Traceroute)

Applies to: Ubuntu 26.04 LTS (traceroute 2.1.6) and 24.04 LTS (traceroute 2.1.5), mtr 0.95, tcptraceroute 1.5beta7; Windows tracert from Microsoft’s documentation

On Ubuntu, traceroute is not installed by default. Install it with sudo apt install traceroute, then run traceroute example.com. If the output is mostly *, try ICMP (traceroute -I) or TCP (sudo traceroute -T -p 443), because many networks drop the UDP probes that traceroute sends by default.

1. Install traceroute

Without the package, Ubuntu answers traceroute: command not found. Install it:

sudo apt update
sudo apt install traceroute
traceroute --version

Modern traceroute for Linux, version 2.1.6

Two related tools may already be there: the ubuntu-standard package recommends iputils-tracepath (the tracepath command) and mtr-tiny (mtr).

2. Run a traceroute and read the output

traceroute -n 1.1.1.1

traceroute sends probes with a time-to-live (TTL) of 1, 2, 3 and so on. Each router on the way that drops a probe because its TTL ran out answers, and that answer becomes one line of output: the hop number, the router’s address and the round-trip time of each probe. It stops at the destination or after 30 hops, sending three probes per hop by default.

• * means no answer within the wait time. A few stars in the middle are normal: many routers don’t answer traceroute probes but still forward traffic.
• Stars from one hop to the end mean the probes are blocked from there on, or the path really stops.
• !H, !N and !P mean host, network or protocol unreachable; !X means communication administratively prohibited (a firewall).
• A jump in time that stays high on every later hop shows where the delay starts. A high time on one hop only, with normal times after it, is usually just a router that answers slowly.

3. UDP, ICMP or TCP

By default traceroute sends UDP packets to unlikely ports, starting at 33434. Firewalls often drop them. In our test, the default method showed only stars after the first hop, while ICMP and TCP reached the target:

$ traceroute -n -q 1 -m 3 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 3 hops max, 60 byte packets
 1  172.17.0.1  0.076 ms
 2  *
 3  *

$ traceroute -n -I -q 1 -m 10 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 10 hops max, 60 byte packets
 1  172.17.0.1  0.099 ms
 2  1.1.1.1  53.319 ms

• -I uses ICMP echo, like ping. It works without sudo on Ubuntu, because systemd’s default net.ipv4.ping_group_range setting allows unprivileged ICMP.
• -T -p 443 uses TCP SYN packets to port 443 (port 80 if you leave out -p). This is the best test for “why can’t I reach this website or port”, because the probes look like real connections. It needs root: without sudo we got You do not have enough privileges to use this traceroute method.
• tcptraceroute (its own package) does the same: sudo tcptraceroute 1.1.1.1 443 printed 1.1.1.1 [open] on the last line when the port answered.

4. Useful options

• -n: show IP addresses only. Much faster, because it skips a DNS lookup for every hop.
• -m 15: stop after 15 hops (default 30).
• -q 1: one probe per hop instead of three.
• -w 2: wait at most 2 seconds for each answer (default 5).
• -4 or -6: force IPv4 or IPv6.

5. mtr for a better picture

mtr combines traceroute and ping and keeps sending, so it shows packet loss per hop. For a report you can paste into a support ticket, run it from both ends if you can:

mtr -r -c 100 -n 1.1.1.1
sudo mtr -r -c 100 -n -T -P 443 1.1.1.1   # TCP to port 443

HOST: web01                       Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 172.17.0.1                 0.0%     3    0.1   0.2   0.1   0.2   0.0
  2.|-- 1.1.1.1                    0.0%     3   40.7  41.7  40.7  43.6   1.6

Look at the loss on the last hop first. If a middle hop shows loss but the hops after it don’t, traffic is getting through: that router only answers fewer probes. More in diagnose network issues with MTR.

Traceroute from Windows

The Windows command is tracert. According to Microsoft it sends ICMP echo requests, so it behaves like traceroute -I; tracert /d skips the name lookups, like -n. See how to use traceroute. For a quick reachability check on Linux, see ping command examples.

When you report slow or broken connections to a Ucartz server, include an mtr or traceroute from your side to the server’s IP address and, if you can, the reverse from the server. That shows us straight away where the path breaks.

Official documentation: traceroute(1) manual.