Traceroute Command on Windows, Mac and Linux, With Examples

Every operating system ships a traceroute command, but each one spells it differently, uses a different protocol by default and hides different options. This guide gives the exact command for Windows, macOS and Linux, the options worth knowing, and a real output explained line by line.

The command on each system

System	Command	Default probe	Installed?
Windows 10 and 11	tracert example.com	ICMP	Yes
macOS	traceroute example.com	UDP	Yes
Linux	traceroute example.com	UDP	Often not: sudo apt install traceroute
Linux, no install	tracepath example.com	UDP	Yes (iputils)
Any, continuous	mtr example.com	ICMP	Install it (Homebrew, apt, dnf)

The default probe matters more than it looks. Many firewalls drop UDP to high ports but let ICMP through, and the reverse happens too. When a trace fills up with asterisks on one system and not on another, the protocol is usually the reason, not the network.

Windows: tracert

Open Command Prompt or PowerShell and run:

tracert example.com

The options you will actually use:

• -d: do not resolve addresses to names. The trace runs much faster, because each hop otherwise waits for a reverse DNS lookup.
• -h 40: maximum number of hops (30 by default). Raise it for distant destinations.
• -w 2000: how long to wait for each reply, in milliseconds (4000 by default).
• -4 or -6: force IPv4 or IPv6.

A fast, readable trace is therefore tracert -d -w 1000 example.com. Windows also has pathping, which traces the path and then pings each hop for several minutes to measure loss: slow, but closer to what mtr gives.

macOS: traceroute

Open Terminal and run:

traceroute example.com

• -n: no name resolution, faster output.
• -I: send ICMP instead of UDP, like Windows.
• -P TCP -p 443: send TCP probes to port 443, the one most firewalls leave open.
• -m 40: maximum hops (64 by default on macOS).
• -q 1: one probe per hop instead of three, for a quicker first look.

For IPv6 destinations macOS uses a separate command, traceroute6. To get mtr, install Homebrew and run brew install mtr; it needs sudo to send its probes.

Linux: traceroute, tracepath and mtr

Many distributions do not install traceroute by default. Install it with sudo apt install traceroute on Debian and Ubuntu, or sudo dnf install traceroute on Fedora and RHEL. Then:

traceroute example.com

• -n: no name resolution.
• -I: ICMP probes (needs sudo).
• -T -p 443: TCP SYN probes to port 443 (needs sudo). The best option when a firewall blocks the other two.
• -m 40: maximum hops (30 by default).
• -4 or -6: force the address family.

If you cannot install anything, tracepath example.com is part of iputils, runs without root, and also reports the path MTU. For repeated measurements, mtr -rwc 10 example.com prints a report after ten cycles per hop, with loss and latency statistics.

A real output, explained

This trace ran on 26 September 2026 from a server in Falkenstein, Germany, to Cloudflare's resolver:

traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets
 1  172.20.0.1  0.100 ms  0.043 ms  0.035 ms
 2  213.133.117.208  0.338 ms  0.314 ms  0.306 ms
 3  213.133.126.22  0.372 ms  0.364 ms 213.133.126.24  0.427 ms
 4  213.239.224.90  4.972 ms 213.239.224.82  5.011 ms 213.239.224.14  5.087 ms
 5  213.239.224.221  5.340 ms  5.289 ms 213.239.245.126  5.248 ms
 6  162.158.84.254  5.937 ms 213.133.112.34  5.864 ms 162.158.84.254  5.484 ms
 7  162.158.84.78  5.348 ms  5.299 ms  5.302 ms
 8  162.158.84.235  5.934 ms  5.838 ms 162.158.84.219  15.970 ms
 9  1.1.1.1  5.621 ms  5.548 ms  5.635 ms

• Each line is one router, and the three times are three separate probes. Hop 1 is the local gateway; hop 9 is the destination.
• Several addresses on one line (hops 3 to 6) are not an error. The provider spreads traffic over parallel links, and each probe took a different one. This is called ECMP.
• The jump at hop 4, from under 1 ms to 5 ms, is the distance from Falkenstein to Frankfurt. The names prove it: run without -n, hop 3 resolves to core22.fsn1.hetzner.com and hop 4 to core4.fra.hetzner.com. Router names often carry a city or airport code, which is how you locate a hop. From hop 6, the 162.158.x.x addresses belong to Cloudflare.
• The 15.970 ms at hop 8 is not a problem. The destination answers in 5.6 ms right after it. A router that answers probes slowly while forwarding traffic at full speed is the most common false alarm in any traceroute.

The same path through mtr -rwn -c 5 1.1.1.1 shows the same trap in its statistics: hop 6 averages 15.3 ms with a worst of 39.9 ms, while hops 7 to 9 stay near 6 ms. Only latency or loss that starts at a hop and continues to the destination is real.

Asterisks, timeouts and "request timed out"

A line of * * * (or "Request timed out." in tracert) means no reply came back for that hop. If later hops answer, that router simply ignores probes, and nothing is wrong. If every line after a certain hop is asterisks, try another protocol first: -I for ICMP, then -T -p 443 for TCP on Linux or -P TCP -p 443 on macOS. Only when all three stop at the same place is the path really broken there.

When the command line is not enough

A traceroute from your computer shows one path: from your network, at this moment. Three situations need more:

• Your network blocks the probes. Offices and some mobile networks drop outgoing ICMP and high UDP ports, so every hop times out.
• The problem is not on your side. To know whether a slowdown comes from your provider or from the destination, trace the same host from somewhere else and compare.
• You need to show someone. A map with the network (AS) behind each hop is easier to hand to a support team than a text dump.

TraceMapper runs the same traceroute from our servers and from 35 locations in 31 countries, puts every hop on a map with its latency, loss and network, and keeps the result as a link you can share. For the reasoning behind each column, see how traceroute works; to choose a protocol, see UDP vs ICMP vs TCP traceroute.