Shadowing Practice: Traceroute: You're Probably Reading the Results Wrong - Learn English Speaking with Video

If you work in IT, you've probably used Traceroute at least a few times, but I bet some of you have no idea how it actually works.

It's one of the first tools we reach for when we're trying to figure out where a network connection is dying.

You run it, you see a list of hops, you find out where it times out, and you're basically done.

But there's some really cool stuff happening underneath the hood that changes how you should actually interpret those results.

Okay, so at its core, traceroute is exploiting something called the TTL field in the IP header.

TTL stands for time to live, and it's basically a hop counter.

Every time a packet passes through a router, that router reduces the TTL by one.

When the TTL hits zero, the router drops the packet and sends back an ICMP time exceeded message to the source.

Now, I know that just sounded like a lot, but stick with me.

This is all gonna make sense in a minute.

Trust me.

Okay?

All right.

Now, traceroute starts by sending out a packet with a TTL of 1.

That packet hits the first router.

The router reduces the TTL to zero, drops it, and then sends back the time-exceeded message.

And then boom, now Traceroute knows the IP address of the first hop and how long it took to get there.

Then it sends out another packet with a TTL of two.

That packet makes it to the first router, hits the second router, gets dropped, and then the second router sends back a time exceeded message.

Now, Traceroute knows the second hop.

I think you can see where I'm going with this.

It keeps doing this, incrementing the TTL each time until it finally reaches the destination.

Now, but you might be asking, how does it know what hop is the destination?

Well, that's a very good question.

It knows this because at the last hop, instead of getting an ICMP time exceeded, it gets an ICMP echo reply or port unreachable message.

It kind of depends on the protocol you're using, but that's how it knows it's done.

Now, here is where it gets interesting.

Traceroute on Windows and Traceroute on Linux work differently by default.

Windows uses ICMP echo requests,

basically a ping packet, and Linux and Unix use UDP packets to high numbered ports.

Now you might be asking, why does that matter?

Well, it's because firewalls and routers treat these differently.

A lot of networks block ICMP, or at least they rate limit it, so that they deprioritize that traffic.

So if you're running traceroute on Windows and you're seeing a bunch of timeouts, it might not actually be because the path is broken.

It might be because the ICMP is being filtered somewhere along the way.

If you run the same traceroute using UDP or TCP, you might get a completely different result.

And also, this is really important.

The path you see in traceroute is not necessarily the path your actual traffic is taking.

Routers can use different paths for different types of traffic.

They can use something called ECMP or equal cost multipath, meaning there might be multiple paths to the same destination

and your trace route packets might take a different path than your actual application traffic.

Oh, one more thing.

Those round trip times you see in trace route, they're not cumulative.

Each hop shows the round trip time from your source to that specific router and back.

So if you see hop three with a 20 milliseconds time and a hot four with a 15 milliseconds, that doesn't mean hot four is faster.

That just means hot four responded faster to the ICMP request.

The actual latency is still accumulating as you go.

So what do you actually need to remember?

Traceroute is an amazing tool, but you need to understand what it's actually showing you.

It's not a perfect map of your traffic path.

And those timeouts don't always mean there's a problem.

Sometimes you need to run it with different protocols or run it multiple times to see if the path changes.

Now you know how traceroute actually works under the hood.

I hope that helped and don't forget to follow me nerds.

✨ Recommend Video

176 sentences

What is the Shadowing Technique?

Shadowing is a science-backed language learning technique originally developed for professional interpreter training and popularized by polyglot Dr. Alexander Arguelles. The method is simple but powerful: you listen to native English audio and immediately repeat it out loud — like a shadow following the speaker with just a 1–2 second delay. Unlike passive listening or grammar drills, shadowing forces your brain and mouth muscles to simultaneously process and reproduce real speech patterns. Research shows it significantly improves pronunciation accuracy, intonation, rhythm, connected speech, listening comprehension, and speaking fluency — making it one of the most effective methods for IELTS Speaking preparation and real-world English communication.

Shadowing technique: read the full step-by-step guide →

Shadowing Practice: Traceroute: You're Probably Reading the Results Wrong - Learn English Speaking with Video

Every Networking Concept Explained | Networking 101 (2026)

"This Doesn't Lie" | Build Your Own English Level Checker with Google AI Studio

A Career in IT

Flying a plane badly, on purpose.

BGP Overview

Turing & The Halting Problem - Computerphile

How Does a URL Shortener Work?

Every Hardware Protocol Explained Simply in 10 Minutes!

How to Become Your Own ISP

System Design: Why is Kafka Popular?

Watch this before you boot up another device

Why Do You Need BOTH a MAC and IP Address?

Vocabulary and speaking notes for this lesson

Key vocabulary in this video

Phrasal verbs you will hear

Pronunciation to watch

How to practise with this video

What is the Shadowing Technique?