Combine Ping and Traceroute with MTR

MTR (My Traceroute) combines the real-time probing of ping with the route discovery of traceroute into a single tool, giving you a continuous view of packet loss and latency at every hop between your machine and a destination. You run it with a hostname or IP address, and it updates a table of each router along the path, showing current and average loss and latency until you stop it. This makes it the go-to diagnostic for network issues that are intermittent, route-specific, or hard to reproduce with a single ping or traceroute.

What MTR Actually Does

MTR works by sending a series of packets to each hop along the route, just like traceroute does, but it keeps sending them continuously rather than stopping after one pass. For each hop, it reports the loss percentage, the minimum, average, and maximum round-trip times, and the standard deviation of those times. The key difference from a single traceroute is that MTR samples over time, so it can reveal intermittent loss or latency spikes that a one-shot traceroute would miss.

The tool is available on most Linux distributions as mtr, on macOS as mtr (installable via Homebrew), and on Windows as WinMTR, a graphical port. The command-line version is typically invoked as mtr example.com, and you can add --report to run a fixed number of cycles and print a summary, or --report-cycles=10 to control how many cycles. The default is interactive, refreshing the display every second.

Why MTR Is More Useful Than Ping or Traceroute Alone

Ping tells you whether a host is reachable and how fast it responds, but it gives you no information about the path. Traceroute shows you the path, but only as a snapshot; if a router drops packets intermittently, a single traceroute may show zero loss. MTR combines the two, letting you see both the route and the ongoing health of each hop.

For example, if you are experiencing slow web browsing, a single ping to the server might show 20 ms latency, which looks fine. A traceroute might show 15 hops, all responding. But an MTR run over 30 seconds could reveal that hop 12 drops 15% of packets, causing TCP retransmissions and perceived slowness. That is the kind of diagnosis you cannot get from either tool alone.

How to Read MTR Output

The MTR display has columns for the hop number, the hostname and IP, loss percentage, sent/received packet counts, and latency statistics (best, avg, worst, stdev). The critical thing to understand is that loss at a particular hop does not necessarily mean that router is broken. Many routers are configured to rate-limit or drop ICMP packets, so they will show loss even when they are forwarding traffic fine. The loss that matters is the loss at the final destination; if the last hop shows 0% loss, the intermediate hops showing loss are likely just not responding to ICMP.

Another common pattern is that loss appears at one hop and continues for all subsequent hops. That usually means the loss is happening at that hop or somewhere between it and the next, and the packets are being dropped before reaching the later hops. If loss appears only at a single middle hop but the final hop is clean, the middle router is probably deprioritizing ICMP.

Common Problems and Misconceptions

One of the most frequent mistakes is interpreting intermediate loss as a problem. A router that drops 100% of ICMP packets but still forwards traffic will show 100% loss in MTR, yet the connection may be perfectly healthy. Always check the final hop first.

Another issue is that MTR uses ICMP by default, but some networks block or throttle ICMP. You can switch to TCP or UDP probes with -T (TCP) or -U (UDP) to get a more accurate picture of real traffic. For example, mtr -T example.com sends TCP SYN packets, which are more representative of actual web traffic.

A third misconception is that MTR can tell you exactly which ISP is at fault. While you can identify the IP ranges of different providers, the path may cross multiple autonomous systems, and the loss could be due to congestion at a peering point, not a single router. You can use the -z flag to show AS numbers, which helps identify which network each hop belongs to.

How to Choose Between MTR, Ping, and Traceroute

Use ping when you need a quick check of reachability and latency to a single host. Use traceroute when you want to see the path once, for example to verify that traffic is taking an expected route or to identify a routing loop. Use MTR when you need to diagnose an ongoing problem, especially one that is intermittent or that you suspect is caused by a specific hop.

For a practical workflow, start with a ping to confirm the host is up. If it is up but slow or lossy, run MTR for a few minutes. If you see loss at the final hop, the problem is likely at the destination server or its network. If you see loss at an intermediate hop that persists to the end, the problem is along the path. If you see loss at an intermediate hop but not at the end, it is likely ICMP rate-limiting and not a real issue.

Alternatives and Related Tools

Besides MTR, there are other tools that combine similar functionality. traceroute with the -n flag can speed up diagnostics by skipping DNS lookups. ping with the -f flag (flood) on Linux can stress-test a link, but it should be used with caution as it can cause congestion. For continuous monitoring, Smokeping is a more elaborate tool that graphs latency over time. On Windows, PathPing is a built-in tool that combines ping and traceroute, but it runs a single traceroute followed by pinging each hop for a while, rather than continuously probing all hops like MTR.

Safety and Etiquette Considerations

MTR sends a continuous stream of packets, which can be seen as aggressive if pointed at a server you do not own. For troubleshooting your own connection, it is fine, but be mindful of the load on intermediate routers. Using the --report mode with a limited number of cycles (e.g., --report-cycles=10) is a polite way to get a summary without running indefinitely. Also, be aware that some networks have policies against continuous probing; if you are diagnosing a problem with a service provider, they may ask you to run MTR for a specific duration and capture the output.

Frequently Asked Questions

What does MTR stand for? MTR stands for My Traceroute, originally a combination of the ping and traceroute commands. The name is a play on the classic traceroute tool.

Why does MTR show loss at a hop but the final hop is fine? This is usually due to ICMP rate-limiting. Many routers prioritize forwarding traffic over responding to ICMP echo requests, so they drop some or all of those packets. The actual data path is unaffected, which is why the final hop shows no loss.

Can MTR be used on Windows? Yes, WinMTR is a popular graphical implementation for Windows. There is also a command-line port called mtr that can be run under Cygwin or WSL (Windows Subsystem for Linux).

How long should I run MTR to get a useful result? For intermittent issues, run it for at least 30 seconds to a few minutes. The --report-cycles=10 option sends 10 packets per hop, which is a good baseline. For a more thorough test, let it run for 100 cycles or more.

Does MTR work with IPv6? Yes, MTR supports IPv6. You can use the -6 flag to force IPv6, and it will display IPv6 addresses and routes. The same interpretation rules apply.

What is the difference between MTR and PathPing? PathPing on Windows sends a traceroute first, then pings each hop for a set number of times (default 100). MTR continuously probes all hops simultaneously, giving a more real-time and complete picture. MTR also has more options for probe types and output formatting.

Related

• Skype Versions Supported on OS X
• Voltage Nest Hello: Compatibility and Power Explained
• Powerline Networking vs Ham Radio Interference

in t | Finish time | min | 50 | 0
in d | Distance | km | 10 | 0 | 100000
out pace | Average pace | min/km | t / d | 2
out speed | Average speed | km/h | d / (t / 60) | 2