How to Read a Traceroute (and Find Where the Slowness Is)

A traceroute shows the path your data takes across the internet to reach a destination, listing every router ("hop") along the way and how long each one took to respond. It is one of the most useful tools for answering a simple question: where is the slowness or the failure happening? You can run one any time with the Traceroute tool. This guide explains how to read the output without guessing.

Your data does not go straight to a server. It passes through a chain of routers. Traceroute deliberately sends packets with a short "time to live" that increases by one each round. Each router that has to drop an expired packet reports back, which is how traceroute discovers the hops one by one and measures the round-trip time to each.

The key idea is that each line is one hop further along the path, and the times shown are round trips to that hop, not the time between one hop and the next. Reading it as a cumulative picture rather than per-segment timings is what keeps you from misdiagnosing.

A typical line shows a hop number, an IP address or hostname, and three time measurements such as 18.4 ms, 17.9 ms, and 18.1 ms. The hop number tells you how many routers deep you are. The IP or hostname identifies the router that responded, and the hostname often hints at the location and provider through a city code or carrier name. The three times come from traceroute pinging each hop three times, and consistent numbers indicate a stable hop.

You can look up any hop's IP with the IP Information tool to see its provider and location, or check the network it belongs to with the ASN Lookup lookup. This is how you turn a list of anonymous routers into a story about whose network your traffic is crossing.

If round-trip times jump at one hop and stay high for every hop after it, that hop is likely where congestion or a long physical distance begins. For example, hops one through six at around 10 ms followed by hop seven onward all at around 120 ms points to a real increase at hop seven that carries downstream. By contrast, a single high hop whose next hops drop back down is usually not a problem, because routers deprioritize replying to traceroute, so a lone spike that does not persist is normal.

A hop showing asterisks means it did not reply in time. This is common and often harmless, since many routers are configured not to answer traceroute. It only matters if every hop from there to the end is also stars, which suggests the path genuinely breaks at that point. If the trace never reaches the destination and the last several hops are timeouts, the packets are being dropped somewhere, and the last hop that did respond tells you roughly where the path stops and whose network it is on.

Start by running a Ping to the destination. If ping shows high latency or packet loss, traceroute will help locate it; if ping is fine, you may not have a network problem at all. Then look at where the latency jumps. The earliest hops are your local network and ISP, so a jump there means the issue is close to you, while a jump deep in the path points to an intermediate carrier or the destination's network.

Identify the owner of the hop where things degrade using the IP Information and ASN Lookup tools. If it belongs to your ISP, that is who to contact; if it is the destination's host, the problem is on their side. A useful trick is to trace to both the slow site and a known-fast one: if they share a slow hop, that shared carrier is the culprit.

Imagine a trace where the first hop is your router at about 1 ms, the second is your ISP at about 9 ms, and hops three through five sit around 11 to 15 ms. Then hop six jumps to roughly 96 ms and hop seven and the destination stay near 98 ms. Reading it, everything is healthy until hop six, where latency jumps and stays high to the end, so the problem is at that intermediate carrier, not your ISP and not the destination server.

If one of the middle hops had instead shown a single line of asterisks while the hops around it were fast, you would simply ignore it as a quiet router. The signal you care about is sustained latency from a hop onward, not isolated spikes or single silent hops.

Why do some hops show asterisks? That router chose not to reply to traceroute, which is common and usually fine. Only worry if all remaining hops are stars too, which suggests the path actually breaks there.

Why is one hop slow but the rest are fast? Routers treat traceroute replies as low priority, so a lone spike is normal. Sustained high latency from a hop onward is the real signal.

Does a high first or second hop mean my internet is bad? The first hop is your own router and the second is usually your ISP, so high latency there points to a local or last-mile issue worth investigating.

Traceroute and ping disagree. Which do I trust? Use the Ping tool to confirm there is a real latency or loss problem to the destination, and the Traceroute tool to locate where along the path it starts.