# How to interpret traceroute results? [duplicate]

So, I have a task which involves calculating the RTT to a destination. Now, I have done it using ping. But, I need to do it using `traceroute` too. From, my knowledge about `traceroute`, I know that it displays the RTT of hops. Usually, it displays 3 values for it, we can do some averaging here for hop delay. Now, I want to know if it is possible to estimate the end-to-end delay with it. I have found conflicting answers when I search on the internet. Some say we need to average the three RTT values of each row, and then add all these up to get the final results. Another answer which I found was to use the average of the last row only, i.e. each subsequent hop incorporates the values of the previous hop, so we need to check only the find RTTs for source to destination.

Which one of these is correct?

``````traceroute www.google.com
traceroute to www.google.com (142.250.182.228), 64 hops max, 52 byte packets
1  * * *
2  192.168.1.5 (192.168.1.5)  3.464 ms  4.906 ms  2.743 ms
3  14.139.204.209 (14.139.204.209)  5.977 ms  5.554 ms  8.523 ms
4  * * *
5  * * *
6  10.119.73.122 (10.119.73.122)  31.345 ms  27.402 ms  29.750 ms
7  72.14.213.20 (72.14.213.20)  61.198 ms
72.14.195.128 (72.14.195.128)  59.879 ms  57.858 ms
8  * * *
9  216.239.59.170 (216.239.59.170)  56.856 ms
142.251.55.72 (142.251.55.72)  51.263 ms
142.251.55.70 (142.251.55.70)  57.444 ms
10  74.125.242.138 (74.125.242.138)  56.551 ms  56.282 ms  58.787 ms
11  142.250.56.38 (142.250.56.38)  62.937 ms
64.233.174.2 (64.233.174.2)  57.297 ms
64.233.174.3 (64.233.174.3)  62.472 ms
12  108.170.248.193 (108.170.248.193)  79.715 ms  79.846 ms
142.250.56.38 (142.250.56.38)  63.350 ms
13  142.250.214.103 (142.250.214.103)  63.828 ms  56.665 ms
108.170.248.193 (108.170.248.193)  81.060 ms
14  142.250.214.103 (142.250.214.103)  59.137 ms  66.597 ms
bom07s29-in-f4.1e100.net (142.250.182.228)  55.834 ms
``````

Like is the answer `avg(59.137, 66.597, 55.834)` or adding the averages for each row. Also, in the output I have shown, I am not able to understand how Row13 has less RTT than Row14 if cumulative calculation is to be believed. Thanks for the help.

## 2 Answers

I know that it displays the RTT of hops.

Not exactly. `ping` and `traceroute` display the round-trip time for ICMP echo request and ICMP TTL expired in transit alone. The difference to actually used transport layer protocols is that ICMP may be processed with a very low priority. Therefore, `ping` times are the likely upper bound of real-life RTT.

The sometimes decreasing values you see from one hop and the next (which intuitively should always be increasing) are caused by varying IMCP processing.

For practical RTT measurement you should use real traffic and gauge real packets (e.g. by capturing the packets).

it displays 3 values for it

`traceroute` sends three probes per hop/TTL count, each result displayed individually. If you're fine with the ICMP restrictions outlined above you could calculate an average over those three values.

Traceroute uses ICMP error messages as the TTL expires. Generating ICMP error messages is a low-priority task for a router, so you may have one hop that waits to send back an ICMP error, giving you a long time for that particular hop. That slow hop may forward traffic is a reasonable amount of time because that is its primary task, but the ICMP error is returned slowly because that is not the primary task of the router.

It is only the final destination times that are correct.

You also need to understand that ping or traceroute times bear no relationship to the actual RTT for regular traffic.