traceroute Command: Installation, Usage and the -n, -I, -T Options

Test environmentRHEL familyAlmaLinux 9.8root accountDebian 12 · traceroute 2.1.2 regular accountChecked 2026-10-29

To see, hop by hop, the routers that packets pass through on the way to a destination, use the traceroute command. traceroute was not installed on the AlmaLinux 9.8 server, so we installed it with dnf, and when we traced the route to example.com on a Debian 12 server that includes traceroute 2.1.2, the packets reached the destination at the seventh hop.

The output below is from the Debian 12 server, run as a regular account, and only the rpm and dnf output in the installation section came from the AlmaLinux 9.8 server (root account). The server host name was changed to server1, and the router and destination addresses in the paths were changed to example addresses (192.0.2.x, 198.51.100.x, 203.0.113.x). The release number of the installed package (major version 2.1 is unchanged) and the dnf metadata time are also example values, and response times are left exactly as measured.

TOC

4mn read

1️⃣ Installing traceroute

↪️ dnf on RHEL-based systems, apt on Debian-based systems

Whether traceroute is installed by default depends on the distribution. Running it on the AlmaLinux 9.8 server returned [traceroute: command not found], and an rpm query found no installed package.

rpm -q traceroute

package traceroute is not installed

On RHEL-based systems, install it with dnf. A preview with [--assumeno] showed a single package to install, traceroute from the baseos repository, with no other packages installed alongside it.

dnf install --assumeno traceroute

Last metadata expiration check: 0:05:00 ago on Thu Oct 29 09:00:00 2026.
Dependencies resolved.
================================================================================
 Package            Architecture   Version                 Repository      Size
================================================================================
Installing:
 traceroute         x86_64         3:2.1.0-9.el9           baseos          56 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 56 k
Installed size: 107 k
Operation aborted.

The download size was 56k and the installed size was 107k. [--assumeno] answers no to every prompt, so nothing is installed and the command ends with [Operation aborted.] (per the official dnf documentation).

The actual installation was done with [dnf install traceroute], without [--assumeno].

dnf install traceroute

Last metadata expiration check: 0:20:00 ago on Thu Oct 29 09:00:00 2026.
Dependencies resolved.
================================================================================
 Package            Architecture   Version                 Repository      Size
================================================================================
Installing:
 traceroute         x86_64         3:2.1.0-9.el9           baseos          56 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 56 k
Installed size: 107 k
Downloading Packages:
traceroute-2.1.0-9.el9.x86_64.rpm               3.6 MB/s |  56 kB     00:00    
--------------------------------------------------------------------------------
Total                                            97 kB/s |  56 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : traceroute-3:2.1.0-9.el9.x86_64                        1/1 
  Running scriptlet: traceroute-3:2.1.0-9.el9.x86_64                        1/1 
  Verifying        : traceroute-3:2.1.0-9.el9.x86_64                        1/1 

Installed:
  traceroute-3:2.1.0-9.el9.x86_64                                               

Complete!

Only the traceroute package appeared under [Installed:], and the installation finished with [Complete!] without any dependency packages.

After installing, we checked the version with [traceroute --version].

traceroute --version

Modern traceroute for Linux, version 2.1.0
Copyright (c) 2016  Dmitry Butskoy,   License: GPL v2 or any later

The executable path found with [command -v traceroute] was [/usr/bin/traceroute].

On Debian-based systems, install the traceroute package from the distribution repository with [apt install traceroute] (per the official Debian package information). Check the installed version with --version.

traceroute --version

Modern traceroute for Linux, version 2.1.2
Copyright (c) 2016  Dmitry Butskoy,   License: GPL v2 or any later

The traceroute package was already installed on the Debian 12 server, and the version appeared as [Modern traceroute for Linux] 2.1.2.

2️⃣ How to use the traceroute command

↪️ Basic form and how to read the output

traceroute takes a destination name or IP address and sends packets with a TTL that starts at 1 and goes up one at a time. A packet with a TTL of 1 expires at the first router, and a packet with a TTL of 2 expires at the second. From the [time exceeded] replies those routers send back, traceroute prints the address and round-trip time for each hop (per the official manual).

When a packet reaches the destination, the destination replies with [port unreachable] and the trace ends at that hop; if it never gets there, the trace continues up to the maximum hop count. Per the official manual, three packets are sent per hop, so each line shows three times, and up to 30 hops are checked by default.

For example.com, we printed addresses only with -n and checked only up to the tenth hop with -m 10.

traceroute -n -m 10 example.com

traceroute to example.com (203.0.113.154), 10 hops max, 60 byte packets
 1  192.0.2.1  0.110 ms  0.083 ms  0.067 ms
 2  192.0.2.2  0.348 ms  0.273 ms  0.263 ms
 3  198.51.100.77  0.426 ms  0.337 ms 198.51.100.13  1.251 ms
 4  198.51.100.49  0.968 ms  1.264 ms 198.51.100.53  1.148 ms
 5  * * *
 6  203.0.113.19  1.631 ms 203.0.113.25  2.549 ms 203.0.113.14  1.543 ms
 7  203.0.113.154  1.544 ms  1.656 ms  1.607 ms

The first line showed the destination name, the address actually used, the maximum hop count and the packet size of 60 bytes. The destination address responded at the seventh hop, so the trace ended without going on to the tenth hop, and the whole run took less than a second.

Output	Meaning
traceroute to example.com (203.0.113.154)	The destination name and the address it resolved to, which the packets were actually sent to
10 hops max	Maximum hops to check — set with -m, default 30
60 byte packets	Size of the packets sent — 60 bytes by default for IPv4, 80 bytes for IPv6 (per the official manual)
1	Hop number — the TTL value set on that packet
192.0.2.1	Address of the router that responded at that hop
0.110 ms 0.083 ms 0.067 ms	Round-trip times of the three packets sent to one hop
198.51.100.77 … 198.51.100.13	A line with two addresses because different routers responded to different packets at the same hop
* * *	None of the three packets got a response in time — each asterisk is one packet
!H · !N · !P · !X	Unreachable flags after the time — host, network or protocol unreachable, or administratively prohibited (per the official manual)

The third and fourth hops showed two addresses on one line, and the sixth hop showed three. When different routers respond to the three packets sent to a hop, traceroute prints all the addresses that responded, one after another, as the official manual describes.

Without -n, traceroute converts the responding addresses to host names.

traceroute localhost

traceroute to localhost (127.0.0.1), 30 hops max, 60 byte packets
 1  server1 (127.0.0.1)  0.068 ms  0.048 ms  0.028 ms

Running it on localhost showed the Debian 12 server's host name in the hop column, with the address 127.0.0.1 in parentheses.

3️⃣ traceroute options

↪️ -n, -q, -m and the sending methods -I, -T

The --help output of traceroute 2.1.2 lists 34 options. Among them, we ran -n, -q and -m, which change the output, and -I and -T, which change the packets sent, as a regular account on the Debian 12 server.

[traceroute -n] prints only IP addresses without converting them to host names. With -n on the same localhost, only 127.0.0.1 remained in the hop column.

traceroute -n localhost

traceroute to localhost (127.0.0.1), 30 hops max, 60 byte packets
 1  127.0.0.1  0.073 ms  0.075 ms  0.025 ms

-q sets the number of packets sent per hop, and the default is 3. -q 1 showed one time, and -q 5 showed five.

traceroute -q 1 -n 127.0.0.1

traceroute to 127.0.0.1 (127.0.0.1), 30 hops max, 60 byte packets
 1  127.0.0.1  0.096 ms

traceroute -q 5 -n 127.0.0.1

traceroute to 127.0.0.1 (127.0.0.1), 30 hops max, 60 byte packets
 1  127.0.0.1  0.083 ms  0.028 ms  0.024 ms  0.022 ms  0.022 ms

-m changes the maximum number of hops to check. Entering 256 was rejected with [max hops cannot be more than 255].

traceroute -m 256 -n 127.0.0.1

max hops cannot be more than 255

Packets are sent as UDP by default. -I sends them as ICMP ECHO, and -T sends them as TCP SYN (port 80 by default). These two options are for rechecking a path that filters UDP using a different kind of packet. Run as a regular account, both options left a message about insufficient privileges and ended with exit code 1.

traceroute -I -n 127.0.0.1

You do not have enough privileges to use this traceroute method.
socket: Operation not permitted

traceroute -T -n 127.0.0.1

You do not have enough privileges to use this traceroute method.
socket: Operation not permitted

The official manual lists the default method and -U (fixed destination port 53) as the methods allowed for regular accounts. -I runs as a regular account only when the kernel setting ping_group_range allows that account's group.

cat /proc/sys/net/ipv4/ping_group_range

1	0

The Debian 12 server's value was [1 0], which per the Linux kernel documentation allows no group. -T is not among the methods allowed for regular accounts regardless of this setting, so run these two options from an account with root privileges.

📌 Main options: results from this article

Option	Task	Result in this article
-n	Prints only IP addresses without converting them to host names	On localhost, only 127.0.0.1 remained in the hop column
-q	Sets the number of packets sent per hop (default 3)	-q 1 shows one time, -q 5 shows five
-m	Sets the maximum hops to check (default 30)	With -m 10, example.com ended at the seventh hop; -m 256 was rejected with [max hops cannot be more than 255]
-I	Sends packets as ICMP ECHO	Insufficient privileges message and exit code 1 on a regular account
-T	Sends packets as TCP SYN (port 80 by default)	Insufficient privileges message and exit code 1 on a regular account
-U	Sends UDP with the destination port fixed to 53	example.com showed * * * from the seventh to the tenth hop, and the destination address did not appear

📎 Other options: per the official manual

Option	Task
-w	Sets the maximum time to wait for a response (default 5 seconds)
-p	Sets the port (starting port for UDP, fixed destination port for TCP, starting sequence number for ICMP)
-f	Sets the starting TTL (default 1)
-N	Sets the number of packets sent at once (default 16; lower it for routers that limit their response rate)
-s	Changes the source address to another interface address on the server
-i	Sets the network interface packets go out on (by default, it follows the routing table)
-4	Sends over IPv4 only (IPv4 is the default when a name resolves to both IPv4 and IPv6 addresses)
-6	Sends over IPv6 only

🔲 traceroute command simulator

In the simulator below, you can shorten the example.com path with -m, or try -n, -q, -f (starting hop) and the privileged -I and -T on 127.0.0.1 and localhost.

traceroute command simulatortraceroute 2.1.2

[root@server work]#

This runs only in your browser and sends no real packets. Use ↑↓ to bring back earlier commands.

4️⃣ Hops that don't respond in traceroute

↪️ * * * lines and firewalls

Even if you can change the sending method, a hop that does not respond stays as [* * *]. Per the official manual, each asterisk is one packet that got no response in time, and the wait is at most 5 seconds.

It is easy to read * * * on a middle hop as the path breaking at that point. On the example.com path sent with the default method, only the fifth hop was * * *, but the packets passed that hop, went through the sixth hop and reached the destination at the seventh.

-U sends packets with the destination port fixed to 53. When we sent packets to the same example.com with -U, the router in front of the destination responded at the sixth hop, then * * * continued from the seventh to the tenth hop and the destination address never appeared.

traceroute -U -n -m 10 example.com

traceroute to example.com (203.0.113.154), 10 hops max, 60 byte packets
 1  192.0.2.1  0.176 ms  0.096 ms  0.661 ms
 2  * * *
 3  198.51.100.13  0.622 ms  0.586 ms  0.562 ms
 4  198.51.100.49  0.898 ms  1.314 ms 198.51.100.53  1.159 ms
 5  * * *
 6  203.0.113.9  3.773 ms 203.0.113.27  3.275 ms 203.0.113.14  8.973 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *

The official manual explains that with -U the program on the destination side usually does not respond, so the last hop cannot be seen. On a path where a firewall filters traceroute's UDP ports or ICMP ECHO, no responses come from behind that firewall either, and only * * * continues.

Where * * * appears	How to read it	Recheck
A single middle hop	No response from that hop — if later hops respond, the packets passed through it	Leave it and read the later hops
Before the destination, up to -m	The destination or a firewall in front of it filters that packet or port (per the official manual)	Default method / -T (root) / [-T -p port]
Hops that change with each run	If a router limits its ICMP response rate, some responses may be missing (per the official manual)	[-N 1] · [-w 5]

If the trace stopped before the destination, change the sending method and check again. The official manual introduces -T as a method designed to get through firewalls. For a destination with a clearly open port, such as a mail server, it explains that specifying that port as in [-T -p 25] can get through even when -I cannot.

A * on a middle hop can also change with the sending method or the run. The second hop responded when run with the default method but showed * * * when run with -U. The official manual says some responses may be missing if a router limits its ICMP response rate, and advises lowering the number of packets sent at once with [-N 1]. traceroute also shortens its wait based on the response times it has already received, so if that makes * appear early, specify a single wait time as in [-w 5] to turn the calculation off (per the official manual).

5️⃣ tracepath instead of traceroute

↪️ On servers where installing is difficult

On a server where you cannot install packages, use the tracepath command to check the same path. The AlmaLinux 9.8 server had no traceroute, but tracepath was there as iputils 20210202. The Debian 12 server, on the other hand, had no tracepath. According to the official tracepath manual, tracepath runs without root privileges but has fewer options and sends only UDP. So when you need to change the sending method with -I or -T, or send several packets per hop with -q to compare them, install and use traceroute.

🔢 FAQ & Recommended Content

No, it can't. The exit code was 0 both when the default method reached example.com at the seventh hop and when -U failed to reach it by the tenth hop. Invalid options, out-of-range -m values and name resolution failures ended with 2, and -I and -T on a regular account ended with 1. The exit code only distinguishes execution errors, so to see whether the trace reached the destination, check whether the last line shows the destination address.

Per Microsoft's documentation, Windows tracert sends ICMP Echo Requests while increasing the TTL, whereas Linux traceroute sends UDP packets by default (per the official manual). To check with the same ICMP method as tracert on Linux, add -I.

Set the first TTL with -f and the output starts from that hop. The default is 1 per the official manual, and -f 2 on 127.0.0.1 made the hop numbers start at 2. When the maximum hop is lower than the starting hop, as with -m 0, it was rejected with [first hop out of range].

🔝 Linux Commands

🔗 Recommended Reading

Next step Installing FirewallD on Linux and configuring the daemon How to install FirewallD, which manages server firewall rules with Zones and Services instead of iptables chains, and how to configure its daemon. Read post →

Network · Configuration [Linux] ip command: managing network interfaces and settings The ip command checks and manages network interface status, IP addresses and the routing table.

Firewall · Ubuntu [Ubuntu] Setting up the UFW firewall on Ubuntu How to enable UFW, Ubuntu's default firewall, and check its status and rules.

Checking an A record with basic host usage – same as the nslookup command

Network · DNS Linux host command | DNS lookup command The host command queries DNS to turn host names into IP addresses and IP addresses into host names.

🪐ReferencesOfficial docs / RFC

📡traceroute(1) — Debian 12 manual (manpages.debian.org) 📡Modern traceroute for Linux project (SourceForge) 📡traceroute package — Debian 12 bookworm (packages.debian.org) 📡dnf command reference — --assumeno (official DNF documentation) 📡ip-sysctl — ping_group_range (Linux kernel documentation) 📡tracert — Windows commands (Microsoft Learn) 📡RFC 792 — ICMP (IETF) 📡RFC 5737 — IPv4 addresses for documentation (IETF)

ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays^{(it goes down during event discounts ↓)}does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.