Your internet is slow, but your connection is working. Websites load eventually, but something feels off. Before you call your ISP and sit on hold for an hour, you can figure out where the problem is yourself. That’s what traceroute is for.

Traceroute shows you every hop your data takes between your computer and a destination. If there’s a slowdown somewhere along the path, traceroute will reveal it.

What traceroute actually does

When you send data across the internet, it doesn’t travel directly from your Mac to the destination. It passes through multiple routers along the way. Your home router, your ISP’s equipment, various internet backbone providers, and finally the destination’s network. Each of these steps is called a hop.

Traceroute works by sending packets with incrementing TTL (time to live) values. The first packet has a TTL of 1, so it expires at the first router. That router sends back an error message saying the packet died, and traceroute records the router’s address and how long it took. Then it sends a packet with TTL 2, which makes it to the second router before expiring. This continues until packets reach the destination.

The result is a map of the route your data takes, with timing information for each hop. You can see exactly where your traffic goes and how long each step takes.

Why you might need traceroute

The most common reason is diagnosing slow connections. If everything feels sluggish, traceroute can show you whether the problem is on your network, your ISP’s network, or somewhere further along the path.

High latency on early hops (1-3) usually points to a local problem. Your router might be overloaded, or there’s congestion on your ISP’s local infrastructure. High latency on later hops suggests the issue is further away and probably out of your control.

Traceroute also helps when a specific site or service is unreachable. You might see the route stopping at a particular hop, indicating where the connection fails. This tells you whether the problem is on your end or theirs.

Developers use traceroute to verify that traffic is routing as expected. If you’re connecting to a server in one region but see hops going through another continent, something is misconfigured.

The Terminal method

On macOS, the command line option is straightforward:

traceroute google.com

This runs a traceroute to Google and prints results line by line as each hop responds. The output shows the hop number, the router’s hostname (if available) and IP address, and three round-trip times in milliseconds.

You can add flags to customize behavior. The -n flag skips DNS lookups and just shows IP addresses, which is faster. The -m flag sets the maximum number of hops. The -q flag changes how many probes are sent per hop.

traceroute -n -m 20 google.com

The output is functional but not pretty. It scrolls by in plain text, and once it’s done you have to scroll back up to see early hops. Comparing multiple traceroutes means running them in separate windows and eyeballing the results.

GUI alternatives

Apple used to include Network Utility, which had a traceroute tab with a graphical interface. You’d enter a hostname, click the button, and watch results populate in a text field. Basic, but it worked without Terminal.

Apple removed Network Utility in macOS Big Sur. If you want a GUI for traceroute now, you need a third-party app.

Some apps are simple wrappers that run the traceroute command and display output in a window. These work, but they don’t add much value over Terminal.

Better options present results in a more useful format. Showing each hop in a table, visualizing latency with color coding, letting you sort and filter results. The underlying data is the same, but the presentation makes it easier to understand.

Reading traceroute results

A typical traceroute output looks something like this:

 1  192.168.1.1 (192.168.1.1)  3.421 ms  2.108 ms  1.892 ms
 2  96.120.68.69 (96.120.68.69)  12.445 ms  11.203 ms  10.987 ms
 3  68.87.167.117 (68.87.167.117)  14.221 ms  13.008 ms  12.445 ms
 4  * * *
 5  72.14.215.171 (72.14.215.171)  18.334 ms  17.112 ms  16.889 ms

Each line is a hop. The number on the left is the hop count. The address in the middle identifies the router. The three times on the right are response times for three separate probes.

Asterisks (* * *) mean the router didn’t respond to probes. This doesn’t necessarily indicate a problem. Many routers are configured to ignore traceroute packets for security reasons. If the route continues beyond the silent hop, traffic is still flowing.

What you’re looking for is sudden jumps in latency. If hops 1-3 are all under 15ms and then hop 4 jumps to 150ms, there’s congestion or a long physical distance at that point. Consistent high latency starting at a particular hop suggests the problem is at or before that router.

Common patterns

High latency on hop 1: Your home router is struggling. It might be overloaded with too many devices, running old firmware, or just failing. Try rebooting it.

High latency on hops 2-3: Your ISP’s local equipment is congested. This often happens during peak usage hours in the evening. Not much you can do except wait or complain to your ISP.

High latency on distant hops: Could be geographic distance (light takes time to travel across oceans) or congestion on backbone networks. Usually out of your control.

Route stopping at a specific hop: The router at that hop or the link beyond it is down. If it’s within the first few hops, your ISP has an outage. If it’s further along, the destination’s network might be having problems.

Route taking a strange path: Sometimes you’ll see traffic go to unexpected locations. A connection to a server in your city might route through another country first. This could be normal (internet routing is complicated) or could indicate misconfiguration somewhere.

Using NetUtil for traceroute

NetUtil includes a traceroute tool with a cleaner interface than Terminal. Enter a hostname, click Trace, and watch the results appear in a table format with proper columns for hop number, address, and timing.

The visual layout makes it easier to spot anomalies. You don’t have to squint at scrolling text or mentally parse columns. High latency hops stand out immediately.

All queries run locally on your Mac. Your traceroutes aren’t logged by anyone and the data never leaves your machine. Some web-based traceroute tools exist, but using them means sending your queries through someone else’s servers.

When to use traceroute

Traceroute is diagnostic, not a fix. It tells you where problems are, not how to solve them. But knowing where the problem is determines what to do next.

If traceroute shows issues on your local network, you can fix that yourself. Reboot your router, check for interference, upgrade your equipment. If it shows problems on your ISP’s network, you have ammunition for a support call. If it shows problems far away on networks you don’t control, at least you know there’s nothing wrong on your end.

The next time your internet feels slow, run a traceroute before assuming the worst. Often the problem is somewhere in the middle of the path, and knowing that saves you from troubleshooting things that aren’t broken.