How to read traceroute output

A traceroute looks cryptic at first, but each line follows the same pattern.

 1  192.0.2.1       0.6 ms
 2  198.51.100.1    4.2 ms
 3  198.51.100.17   9.8 ms
 4  203.0.113.10   12.1 ms

What each column means

The first number is the hop count. Next comes the address (or hostname) of the router that replied, then the round-trip time. Most tools send three probes per hop, so you often see three timings per line.

Common patterns

Asterisks (* * *). The router did not answer. Many routers are configured to ignore probes, so a single line of stars is normal. If every hop after a point shows stars, the packets are being dropped there.

A slow hop in the middle, fast afterwards. Usually harmless. The router is slow to generate a reply but forwards traffic just fine.

Latency jumps and stays high. This is the real signal. If hop 6 adds 80 ms and every hop after it is also slow, the link between hop 5 and 6 is the bottleneck — often a long-distance or congested route.

Latency drops again at the end. Another sign that an intermediate router is rate-limiting replies rather than slowing real traffic.

What to do with it

Copy the output when you contact your host or ISP. A traceroute pointing at a specific hop saves a lot of back and forth. If you want to know when a problem starts instead of catching it live, set up continuous monitoring.