# Traceroute and MTR

Trace the network path to a host or public IP from our server or from probes in other places through Globalping. Returns the hops (address, host name, the network and country we match to it, round-trip times), the AS path, and a rule-based diagnosis that tells real problems from noise: silent routers, loss that does not persist (a router limiting its replies), a delay jump at an ocean crossing, a path that stops short. type mtr repeats the probes to every hop (1 to 16 packets) and adds per-hop loss and delay statistics and a plain text report to send to a provider. Protocol icmp, udp or tcp, IPv4 or IPv6. 1 to 5 places; from REST and MCP at most 5. The target is sent to Globalping.

**Not for:** Proving who is responsible for a problem: routers answer traceroute slowly and some never answer.

- Tool id: `traceroute`
- Category: network
- Execution: fanout
- MCP tool `traceroute` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/traceroute` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `target` | string | yes |  | A host name or a public IP address. A web address works too: the host is taken from it. min length 1, max length 253 |
| `type` | "traceroute" \| "mtr" | no | `"traceroute"` | traceroute: the hops. mtr: repeats the probes to every hop, so each hop shows loss and delay statistics. |
| `mode` | "server" \| "global" | no | `"global"` | server: one check from our own server, no third party. global: from many places through Globalping, a free probe network (the target is sent to it). |
| `preset` | "worldwide" \| "europe" \| "north-america" \| "asia-pacific" \| "south-america-africa" | no | `"worldwide"` | Which part of the world to test from: worldwide, europe, north-america, asia-pacific or south-america-africa. Ignored when `from` is set. |
| `from` | string | no |  | Where to test from, as free text: a country, a city, a network such as AS7922 or Comcast, or a cloud region such as aws-us-east-1. Overrides `preset`. max length 100 |
| `places` | integer | no | `1` | How many places to test from, 1 to 5. From REST, MCP and the web form without JavaScript at most 5 run. min 1, max 5 |
| `eyeball` | boolean | no | `false` | Only home and office networks, not data centres. There are fewer of these, so fewer places may answer. |
| `protocol` | "icmp" \| "udp" \| "tcp" | no | `"icmp"` | icmp is the default. tcp on port 443 passes more firewalls. udp is the classic traceroute. |
| `port` | integer | no | `443` | The destination port for tcp and udp. Ignored for icmp. min 1, max 65535 |
| `family` | "4" \| "6" \| "auto" | no | `"auto"` | auto: whatever the name resolves to. 4 or 6: that family only. |
| `packets` | integer | no | `5` | mtr only: packets sent to each hop, 1 to 16. min 1, max 16 |
| `id` | string | no |  | A Globalping measurement id from a permalink: show that saved result. Set by the page, not by hand. max length 40 |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `target` | string |  |
| `type` | "traceroute" \| "mtr" |  |
| `protocol` | "icmp" \| "udp" \| "tcp" |  |
| `family` | "4" \| "6" \| "auto" |  |
| `mode` | "server" \| "global" |  |
| `paths` | object[] |  |
| `meet` | object | With several places: the first network all the paths share. |
| `measurementId` | string | The Globalping measurement id. A saved result is fetched again by this id for about six months. |
| `startedAt` | string | When the measurement started (ISO 8601, UTC). |
| `incomplete` | boolean | True when the wait ran out before every place finished, so this is what we had. |

## Examples

### The path to github.com

```json
{"target":"github.com","type":"traceroute","mode":"server","preset":"europe","places":1,"eyeball":false,"protocol":"icmp","port":443,"family":"auto","packets":5}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/traceroute?eyeball=false&family=auto&mode=server&packets=5&places=1&port=443&preset=europe&protocol=icmp&target=github.com&type=traceroute'
```

Web page: https://lookupowl.com/traceroute?q=github.com&preset=europe

### MTR to github.com with five packets per hop

```json
{"target":"github.com","type":"mtr","mode":"server","preset":"north-america","places":1,"eyeball":false,"protocol":"icmp","port":443,"family":"auto","packets":5}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/traceroute?eyeball=false&family=auto&mode=server&packets=5&places=1&port=443&preset=north-america&protocol=icmp&target=github.com&type=mtr'
```

Web page: https://lookupowl.com/mtr?q=github.com&preset=north-america

### A TCP trace on port 443 from our server

```json
{"target":"example.com","type":"traceroute","mode":"server","preset":"worldwide","places":1,"eyeball":false,"protocol":"tcp","port":443,"family":"auto","packets":5}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/traceroute?eyeball=false&family=auto&mode=server&packets=5&places=1&port=443&preset=worldwide&protocol=tcp&target=example.com&type=traceroute'
```

Web page: https://lookupowl.com/traceroute?q=example.com&protocol=tcp

## Web pages

- https://lookupowl.com/traceroute
- https://lookupowl.com/mtr

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 60 s.
- Timeout: 60 s.

## Related tools

- [Ping from Many Places](https://lookupowl.com/tools/ping.md): Ping a host from our server or from probes in many countries: does it answer, how fast, and how much is lost.
- [Is It Down? Check a Website from Many Places](https://lookupowl.com/tools/http-check-global.md): Check a website from probes in many places: name lookup, connection, certificate and web server, with a plain verdict.
- [Port Checker: Is a Port Open from the Internet?](https://lookupowl.com/tools/port-check.md): Check whether a TCP port on your connection is open from the internet (the port-forwarding test), or a well-known port on a public server.
- [IP Location Lookup](https://lookupowl.com/tools/ip-location.md): Where an IP address is: city, region, country and the network that runs it, from DB-IP, with an honest accuracy note.
- [ASN Lookup](https://lookupowl.com/tools/asn-lookup.md): Who holds an Autonomous System number: name, country, registry, dates and abuse contact, from RDAP.

## Guide: Traceroute

See the routers between a place and a host, which network runs each one, and whether anything on the way is a real problem.

### How to read a traceroute

A traceroute lists the routers that handed your test packets on, one line per router, in order. Each line is a **hop**. The number at the start is how many routers away it is, the name or address says which router answered, and the time says how long the answer took to come back. The last line should be the host you asked about.

Most people open a traceroute because something is slow or does not load, and then find a wall of numbers. The useful question is narrow: is there one place on the path where things go wrong, and who runs it? We answer that first, in a sentence, and keep the full list underneath for anyone who wants to check our reading.

> **Where the replies came from** Traceroute shows where replies came from, not the path your traffic always takes. Routers can answer slowly or not at all without affecting your traffic.

### What we add to the plain list

A raw traceroute gives you addresses. We look each public address up in our network data and show the network that runs it, so a long path reads as a few stages: your provider, a carrier in the middle, the network of the host you reached. The networks are also listed in order as one short line.

- **Private and shared addresses** are marked. Hops inside the probe network are private; an address in the shared range means your provider puts many customers behind one public address (CGNAT).
- **The biggest step in delay** is highlighted, measured against the previous router that answered, not against the largest number on the page. A step between two continents is named as an ocean crossing, because that cost is expected.
- **Internet exchanges** get a small mark when a hop sits on the peering network of an exchange we know. The list is short, so a missing mark proves nothing.
- **Silent routers** are folded into one line, so a thirty hop path stays short enough to read.

The network and country for each hop come from public routing and registry data and are our best match. They can be missing or wrong, and a hop with nothing shown simply had no match.

### How to use it

1. **Enter a host**: A domain name or a public IP address. A web address works too: we take the host from it. Private and local addresses are refused, because a trace from outside cannot reach them.
2. **Choose where it runs**: From our server is one place. From other places lets you pick a part of the world, or type a country, a city, a network such as AS7922 or a cloud region, with up to five places at once.
3. **Pick a protocol if you need to**: ICMP is the default. TCP on port 443 gets through more firewalls, and UDP is the classic traceroute. You can also ask for IPv4 or IPv6 only.
4. **Read the verdict**: The headline says whether the target was reached and whether anything is really wrong. The hop list, the delay chart and the findings sit underneath.
5. **Share it**: Copy the link to send the same result to someone else. Saved results are kept by the probe network for a limited time, and after that the page offers to run it again.

### Why some hops show nothing

A row of three stars means a router did not answer the test. That is common and usually harmless. Many routers are set to ignore these packets, or to answer them last, while still passing real traffic at full speed.

- Silent hops in the middle of a path, followed by hops that answer, are normal.
- A path that goes quiet and never comes back may be a firewall that drops traceroute. Check the host with a [ping](https://lookupowl.com/ping) or by testing the port with the [port checker](https://lookupowl.com/port-checker) before calling it down.
- A delay that jumps at one router and falls again right after is a slow router, not a slow path.
- A delay that jumps and stays high is worth a closer look at that hop and the network that runs it.

We say which of these you are looking at. When a trace stops, we name the last router that answered and leave the conclusion to you.

### Where it runs and what is sent

A trace needs packets sent from somewhere, and a website cannot send them from your computer. We run traces through Globalping, a free network of volunteer machines in data centres and on home connections. The place you see in the result is the machine that ran the trace.

From our server, our server asks Globalping for one place, and Globalping sees the host and our server address. From other places, your browser asks Globalping itself, but only after you accept a one-time notice, and Globalping then sees the host and your IP address. Without JavaScript, or from the API, our server asks on your behalf. The [privacy page](https://lookupowl.com/privacy) says the same in full.

### Frequently asked questions

**What is a hop?**

A hop is one router on the path. Your packets pass from router to router, and each handoff is one hop. A short path can be six or seven hops and a long one thirty or more.

**Why do some hops show no answer?**

Many routers ignore traceroute on purpose, or answer it with low priority. A silent hop on its own is normal. It matters only when the path goes quiet and never reaches the host.

**The trace stopped before the host. Is the site down?**

Not necessarily. Many firewalls drop traceroute packets while the site works fine. Try the host with a ping from several places, or check that the port is open with the port checker, before you decide.

**Should I use ICMP, UDP or TCP?**

ICMP is the default and works for most paths. If it stops at a firewall, TCP on port 443 usually gets further, because firewalls tend to allow web traffic. UDP is the traditional traceroute and is the one most often filtered.

**Why does the delay not rise steadily along the path?**

Routers answer traceroute themselves, and that is slower than forwarding your traffic. A router in the middle can answer in 40 ms while the rest of the path is fast. That is why we compare each hop with the one before it and look at what comes after.

**Can I trace an address on my own network?**

No. Private, loopback and other non-public addresses are refused, because a probe on the internet cannot reach them. To trace inside your own network, run traceroute on your own computer.

**Can an AI assistant or a script run it?**

Yes. The same trace is available as the traceroute tool in the REST API and the MCP server, with the hops, the networks and the findings as data. From the API at most five places run per request.