Cisco IOS traceroute Command: Path Discovery and Troubleshooting

Learn how to run and interpret Cisco IOS traceroute, understand TTL and response symbols, and isolate routing, interface, ACL, and return-path failures.

What Cisco IOS traceroute Does

Traceroute is a diagnostic command that identifies responding Layer 3 hops between the Cisco IOS device running the command and a destination. A hop is a routed device traversed on the path.

Traceroute reports the responding router at each discovered hop and normally shows the round-trip time: the elapsed time for a probe response to travel back to the source, displayed in milliseconds.

Traceroute is different from a simple reachability test. ping primarily tests whether a destination responds and measures latency. Traceroute progressively reveals the path, helping you locate the part of the path where replies stop or an error is generated.

Basic Cisco IOS Syntax

Run traceroute from privileged EXEC mode, identified by a prompt such as Router#.

Router# traceroute <destination-ip-address-or-hostname>

For example, to trace to the address on R4's FastEthernet0/0 interface:

R1# traceroute 172.16.0.2

The destination can be an IPv4 address or a hostname if name resolution is configured. Cisco IOS sends multiple probes at each hop. It starts with a low IP time-to-live value and increases that value so that progressively farther routers respond.

How Traceroute Discovers Hops

Time To Live (TTL) is an IP header field that limits how many routed hops a packet can cross. Every router that forwards a packet decrements its TTL by one. If the TTL reaches zero, the router discards the probe and normally sends an ICMP TTL-expired message back to the source.

  1. A probe is sent with TTL 1. The first router decrements the TTL to zero and returns a TTL-expired response. That router becomes hop 1.
  2. The next probes use TTL 2. The first router forwards them, and the second router returns the TTL-expired response. That router becomes hop 2.
  3. The process continues with higher TTL values until the destination responds or an error prevents completion.

A probe is an individual test packet sent by traceroute. When a probe reaches the final destination, the destination produces a completion or error response according to the probe type and its own behavior. A destination may respond with an indication such as port unreachable rather than a TTL-expired message.

Traceroute relies on ICMP control and error messages, but the exact probe and response behavior can vary with Cisco IOS version, destination type, filtering, and device policy.

Reading Normal Traceroute Output

A successful trace across the example topology might look like this. The addresses for R2 and R3 are illustrative interface addresses; the important point is the ordered path.

R1# traceroute 172.16.0.2
Type escape sequence to abort.
Tracing the route to 172.16.0.2

  1 10.0.12.2 4 msec 4 msec 5 msec
  2 10.0.23.2 8 msec 9 msec 8 msec
  3 10.0.34.2 12 msec 11 msec 12 msec
  4 172.16.0.2 15 msec 15 msec 16 msec

Cisco IOS traceroute Output Elements

Hop number: The sequence number of the routed hop. Increasing numbers normally represent increasing distance from the source.

Router IP address or hostname: The address or resolved name of the device that returned the response.

Round-trip time in milliseconds: The time for each probe and its response to complete. Higher values can indicate distance, congestion, processing delay, or a slow return path.

Multiple probe results: Cisco IOS sends multiple probes at a hop, so several timing values can appear. Different values can result from normal queuing, load sharing, or varying device response times.

Asterisk (*): A probe did not receive a response before the timeout. It does not by itself prove that the router or path is down.

The displayed address is the interface used by a router to return the traceroute response. It may not be the interface you intuitively expect, especially when a router has multiple links, loopbacks, asymmetric routing, or a different response-address selection behavior.

A real path can contain many routed hops. The destination may be several routers away even when the destination address belongs to an interface on the final router.

Four-Router Topology Example

Consider a routed topology with the path R1 → R2 → R3 → R4. R1 is the source router, and R4's FastEthernet0/0 interface has address 172.16.0.2.

R1 ---- R2 ---- R3 ---- R4
                         Fa0/0: 172.16.0.2

From R1, run:

R1# traceroute 172.16.0.2

The expected successful result lists R2 as the first responding hop, R3 as the second responding hop, and R4 or its destination-facing response address as the final hop. The exact addresses and timing values depend on the interface addressing and the condition of the network.

Using Traceroute to Isolate a Failure

Suppose R3 is powered off, disconnected, or unable to return traceroute responses. A trace from R1 might show R2 and then no response where the next hop is expected:

R1# traceroute 172.16.0.2
Type escape sequence to abort.
Tracing the route to 172.16.0.2

  1 10.0.12.2 4 msec 5 msec 4 msec
  2 *  *  *
  3 *  *  *
  4 *  *  *

The last known-good response is R2. The likely investigation area includes R2's outgoing interface and link toward R3, R3 itself, the link from R3 toward R4, or a policy that prevents the required responses. This output is not conclusive proof that R3 has failed. Filtering, asymmetric routing, control-plane policy, rate limiting, congestion, and return-path problems can also suppress replies while forwarding continues.

Check the last responding router and the affected segment:

  • Verify interface state and addressing with show ip interface brief.
  • Verify a route toward the destination or next-hop network with show ip route.
  • Ping the next-hop address from the last responding router.
  • Review access lists and related security policies with show access-lists.
  • Verify neighbor reachability and the return route on the affected segment.

Traceroute Response Symbols and Result Codes

Timing values represent probe round-trip times in milliseconds. Cisco IOS can also display symbols or letter codes when a probe produces an error or does not complete normally.

Traceroute Response Symbols

Round-trip time value: The probe response time in milliseconds. Compare values with the preceding hops and with ping results.

*: The probe timed out. Investigate loss, congestion, filtering, rate limiting, return routing, or a nonresponding device.

!H / H: Host unreachable. A device reports that the destination host cannot be reached.

A: Administratively prohibited. A policy, ACL, or other security control denied the traffic or prevented the required response.

Q: Source quench or a destination congestion indication. This is a legacy condition and is rarely used in modern networks.

I: The user interrupted the trace, commonly by using the escape sequence.

U: Port unreachable. The destination received the probe but indicated that the relevant port is unavailable.

N: Network unreachable. A device reports that it has no usable route to the destination network.

P: Protocol unreachable. The destination or an intermediate device does not support or cannot deliver the indicated protocol.

T: Timeout. The probe did not receive the expected response within the allowed time.

?: Unknown packet type.

Always interpret a symbol alongside the preceding hop, the topology, routing information, and router policies. A missing response does not necessarily mean that normal data forwarding is also failing.

Failure Isolation Guide

Trace completes normally: The destination responded through the observed path. Continue investigating application behavior, intermittent loss, performance, or traffic-specific policy if the user-facing problem remains.

Trace stops after a known router: Possible causes include an interface or link failure, a missing route, a failed next router, filtering, or a return-path problem. Check the last responding router, its outgoing link, and the next expected router.

Asterisks at one or more hops: The probes timed out. The hop may forward traffic but suppress or rate-limit traceroute responses. Use ping, routing inspection, and interface checks before declaring a path failure.

Host or network unreachable: A router or destination reports an inability to reach the host or network. Check the target address, routing table, route advertisements, static routes, and final-hop connectivity.

Administratively prohibited: A policy blocked the probe or response. Inspect ACLs, control-plane protection, firewall rules, and other security policies. Determine whether only diagnostics are blocked or production forwarding is also affected.

Recommended Troubleshooting Workflow

  1. Confirm the destination. Verify the intended IPv4 address, such as 172.16.0.2, and confirm the expected routed path.
  2. Run the trace from the correct source. Execute traceroute on the Cisco IOS router where the traffic originates.
  3. Find the boundary. Identify the final responding hop and the first missing or error-producing hop.
  4. Check the last known-good router. Use show ip route to verify the route and show ip interface brief to verify interface state.
  5. Test the next hop and destination. Use ping from the relevant router. Compare the result with traceroute and test the next-hop address when possible.
  6. Use source-specific testing. Run extended ping when the return path may depend on the source interface or source IP address.
  7. Review policy. Use show access-lists and inspect applicable security or control-plane policies that can block probes or ICMP error messages.
  8. Use debug cautiously. Enable narrowly scoped debugging only after targeted checks show that packet or protocol visibility is needed.
  9. Document the scope. Record whether the issue affects normal data forwarding, traceroute replies only, or both.

Extended Ping for Return-Path Testing

Standard ping may use an automatically selected source address. Cisco IOS extended ping is interactive and lets you choose parameters such as the source interface or source IP address.

R1# ping
Protocol [ip]:
Target IP address: 172.16.0.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 10.0.12.1

The prompts vary by IOS release and configuration. Select a source address that represents the path you need to validate. This is useful when a trace fails because the destination can be reached from one interface but has no return route to another source network.

Debugging Safely

Cisco IOS debug commands provide advanced diagnostic output about selected control-plane events or traffic processing. Use them only after targeted checks indicate that additional visibility is necessary.

Router# debug <feature-or-protocol>
Router# undebug all

Debug output can consume CPU, memory, console bandwidth, and logging resources. Scope the debug narrowly, run it for the shortest practical period, monitor router performance, and disable it promptly with undebug all. Avoid broad debugging on a busy production router unless you have a safe operational plan.

Common Interpretations and Pitfalls

  • An intermediate router that shows asterisks may still be forwarding traffic normally; it may simply filter, rate-limit, or deprioritize diagnostic replies.
  • A high response time at one hop is not automatically a network delay affecting all later hops. Compare later-hop timings because a router may delay its own control-plane response while forwarding subsequent probes efficiently.
  • Different response addresses can result from multiple interfaces, load sharing, asymmetric paths, or router response-address selection.
  • An incomplete trace can result from a missing return route even when the forward path exists.
  • Traceroute identifies responding Layer 3 hops; it does not prove the health of every physical link, application, firewall session, or end-host service.

Exam-Relevant Notes

  • TTL is decremented by each router and is the mechanism that exposes successive hops.
  • Ping answers “can I reach it and how long does it take?” Traceroute adds “which responding routers are along the path?”
  • Three timing values commonly appear because multiple probes are sent at each hop.
  • * means a probe timed out, not necessarily that the hop is down.
  • !H indicates host unreachable, N indicates network unreachable, and A indicates administratively prohibited.
  • Use the last successful hop as a boundary for investigation, not as conclusive proof of the failed device.

Summary

Cisco IOS traceroute discovers the responding Layer 3 path from the local router to a hostname or IPv4 destination. It uses probes with increasing TTL values, records responding hop addresses and round-trip times, and reports timeouts or error codes when responses are missing. To troubleshoot effectively, combine the trace with routing-table inspection, interface status, ping—including extended ping with a chosen source—ACL review, and carefully controlled debugging.

For a related reference, see Cisco IOS traceroute command usage.