See whose network carries your packets

Each hop is a router your packets pass through on the way to the target. A traceroute reaches them by sending packets with a deliberately small "time to live". It expires one router further along each time, so each router in turn announces itself. The 3 numbers are 3 round-trip samples to that hop, in milliseconds — 3 tries because any single one can be noisy. The MTR-style mode raises that to 10 per hop and adds loss, best, average and worst.

Almost always no. A trace that ends in stars usually means the host, or a firewall in front of it, is dropping the ICMP that traceroute relies on. That is a normal default on hardened servers and cloud instances. The site can be serving traffic perfectly while never answering a single ping. So we don't stop at ICMP. When the trace goes dark, we open a TCP connection to port 443 (then 80) and report whether that succeeded. If it did, the host is up and simply doesn't answer traceroute.

A star is a probe that got no reply within the timeout. In the middle of a path it's usually harmless. That router deprioritises the ICMP replies it has to generate, so it looks lossy while forwarding your real traffic without a hitch. The giveaway is that later hops answer normally. At the end of a path, stars usually mean the destination filters ICMP. Genuine packet loss looks different: it starts at one hop and every hop after it inherits the same loss, target included. We classify the two so you don't chase a cosmetic star.

Usually not. If a single hop reads 200 ms but the hops after it drop back to 20 ms, that router simply answered its own probe slowly. Generating ICMP is a low priority for it, and it forwards everything else quickly. A real bottleneck behaves differently. The jump stays elevated all the way to the destination, because your packets are delayed there too. We only flag a hop as the wall when the jump persists to the target.

Every public IP belongs to an autonomous system — a network run by one organisation, identified by an AS number. Annotating each hop with its ASN and owner turns a flat list of IPs into a story. The probe's network hands the packets to a transit carrier such as Arelion or Cogent, which hands them to your target's provider. When a path is slow or breaks, the AS-path tells you whose network the trouble is on. Yours to fix, your host's, or a transit provider's between them.

Treat it as a hint about shape, not a set of coordinates. We geolocate each hop's IP with the same databases everyone uses. For backbone routers those often return the owning network's registration city, not where the box physically sits: a router labelled "Frankfurt" might be in a datacenter one country over. The map is useful for seeing that your packets crossed an ocean, or looped through an unexpected city. It is not GPS, and we label it that way. Hops that don't geolocate stay unlabeled — we would rather leave a gap than guess.

Large networks often number their internal fabric from private space: the links between their own routers. Those routers still send the "TTL expired" replies traceroute listens for. A 10.x hop in the middle of a public path isn't a leak into your LAN, it's the carrier's plumbing. We label it "private fabric" and attribute it to the surrounding network.

Because a traceroute is one path from one place, and stacking a hundred of them mostly multiplies that caveat rather than removing it. Each run here traces from one of our probes: London, Los Angeles or Singapore. The result names its vantage. Where we spend the effort is on reading the path well: naming the networks, mapping them, and telling a real wall from a lazy router. And if what you actually want is the trace from the moment things broke rather than the moment you asked: Uptimia's monitoring checks a host from many locations on a schedule, and captures a traceroute automatically when a check fails, stored with that incident.