Read Traceroute Loss Without Blaming the Wrong Hop

An intermediate hop shows 70 percent loss in a probing tool, yet the destination answers every probe. It is tempting to mark that router as the cause of an outage. The numbers may instead describe how often the router answers probes addressed to its control plane.

Understand what expires

Traceroute sends probes with successively larger TTL or hop-limit values. An intermediate router may return a time-exceeded message when a probe expires. Generating that response is different from forwarding normal traffic. A router can rate-limit control messages while continuing to forward packets successfully.

If loss at one hop disappears at all later hops and the destination, it is weak evidence of forwarding loss at that hop. If loss continues to the destination and coincides with application failures, the observation is more significant. It still does not identify one faulty device without additional evidence.

Compare like with like

Record source, destination, probe protocol, packet size, time and sample count. Load balancing can send different probes along different routes. Return paths may differ as well. A result collected from your laptop does not automatically describe a customer's route from another provider.

Compare application-level success and latency with the probe series. For a web service, a TCP probe toward the service port may be more informative than unrelated ICMP echo traffic, though it remains a different transaction from an actual HTTP request.

Escalate with a bounded claim

A useful report says that destination loss began during a specific interval, affected defined source networks and coincided with failed requests. Include several samples and any corroborating interface or provider data. Avoid asserting that the first router with unanswered probes is dropping transit traffic. A precise observation gives an upstream engineer something reproducible to investigate.

Further reading

IETF RFC 1812: Requirements for IP Version 4 Routers

Related guide: Trace a Slow Network Request One Phase at a Time.