August 16, 2026

Traceroute is not a looking glass

Traceroute vs looking glass is the argument I have on Slack at least monthly. Traceroute is ICMP or UDP that routers may rate-limit, hide behind MPLS, or answer from an interface that is not the forwarding path. A BGP looking glass is the RIB. When they disagree, I believe the table and I treat traceroute as color commentary.

Stars in the middle of a traceroute are not a hijack. A hop in Frankfurt on the way to Virginia is not a leak. Load-balanced flows that take two exits are not “the internet is broken.” If you need reachability, run ping. If you need origin and path, query the prefix, not the hostname.

How I use traceroute after the looking glass

After I know the origin ASN and the AS path from two collectors, traceroute tells me whether forwarding matches the advertisement and where ICMP gives up. That is useful. It is not evidence. I paste both into the ticket: glass first, traceroute second, IP lookup on the last hop that answered.

If your incident starts with a traceroute screenshot and no prefix, you do not have an incident yet. You have a travel blog.

Lies traceroute tells on purpose

ICMP replies from a loopback. RFC 1812 routers that decrement but do not speak. Anycast last hops that change mid-run. CGNAT that makes the “destination” a door, not a host. Read RFC 2151 if you want the old honesty about diagnostic tools, then go back to the glass.

Table, then packets, then opinions. That order has saved me from more wrong transit calls than any vendor demo.