Why do some traceroute hops show asterisks, and does that mean packets are lost there?
Show the answer
Say this first
An asterisk means no reply came back for that probe before the timeout. It usually is not forwarding loss. Routers rate-limit ICMP generation, drop it with control plane policing, filter it, or have no route back to your source. If later hops and the destination answer normally, traffic passed through that hop fine. Loss is real only when it starts at a hop and continues to every later hop and the destination.
Go deeper
Common causes of * * * at one hop
- The router rate-limits or deprioritizes ICMP it generates.
- CoPP or an ACL drops packets punted to the CPU, which includes TTL-expired probes.
- The router has no route back to your source, common inside provider cores and MPLS networks.
- A firewall in the path drops the probes or the ICMP replies.
Reading the pattern
| Pattern | Meaning |
|---|---|
One hop all *, later hops fine | that router does not answer; ignore it |
* mixed with times at one hop | ICMP rate limiting at that router |
Every hop * from hop N to the end | a real break at or after hop N, or the rest of the path filters that probe type |
Only the last hop * | the destination drops that probe type; try -I or -T -p 443 |
mtr and pathping
Both send many probes and show loss per hop. The same rule applies: loss at an intermediate hop that does not carry through to the destination is ICMP rate limiting at that router.
They will ask next
mtr shows 30 percent loss at hop 4 and 0 percent at the destination. Is there a problem?
Not at hop 4. That router forwards your traffic fine and just answers your probes slowly or rarely. Real loss carries through to the end, so the destination's figure is the one that counts.
Why does a firewall sometimes never appear in a traceroute?
Some firewalls do not decrement TTL by default. A Cisco ASA, for example, stays invisible unless configured to decrement TTL. Others drop the probes or the ICMP replies.
Traps
- Opening an ISP ticket for "loss at hop 5" when the destination shows none.