TTL and ICMP: How ping and traceroute Work

Every IP packet carries a TTL (time to live), a counter that each router lowers by one; a router that brings it to zero drops the packet and sends an ICMP "time exceeded" message back to the sender. The ping tool uses ICMP to ask whether a host answers, and traceroute uses the TTL to make each router on the path reveal itself in turn.

ICMP (Internet Control Message Protocol) is the network layer's own messaging system: it carries error reports and simple tests, not application data. Ping sends an ICMP "echo request" and the target answers with an "echo reply", so a reply proves the host is reachable and how long a round trip, there and back, takes.

Traceroute's trick is to send packets that are meant to die. It sends the first with a TTL of 1, so the first router drops it and replies from its own address. The next has a TTL of 2, so it dies at the second router, and so on until a packet reaches the destination.

Each line of traceroute output is one TTL value: the address that replied, and the round-trip time of usually three probes. On Linux and macOS, traceroute sends UDP packets to unlikely port numbers, and the destination answers with an ICMP "port unreachable", which tells traceroute it has arrived. Windows tracert sends ICMP echo requests instead. The replies from the routers are the same either way.

A line of asterisks, * * *, means no reply came back for that TTL. Usually the router is set not to send time-exceeded messages, or limits how many it sends; the packets themselves passed through, which shows when later lines answer. Asterisks that continue to the end mean the path really does stop there, or the destination ignores the probes.

The TTL also limits damage. A packet caught in a loop between two routers loses one from its TTL each time and is dropped when it reaches zero, typically after 64 hops, instead of circling forever.

So use ping to ask "does this host answer at all", and traceroute to ask "where along the path do my packets stop".