tracepath — Trace the path to a host without root — unprivileged traceroute across all 5 shells
Equivalents in every shell
tracepath google.comFrom `iputils`. Unlike `traceroute`, `tracepath` does NOT require root — it uses UDP probes via the unprivileged path-MTU-discovery infrastructure. Output adds `pmtu` (Path MTU) lines when the MTU changes between hops, useful for diagnosing tunnel / VPN MTU issues. Add `-n` for numeric output (no DNS lookups, ~3× faster).
tracepath google.comSame `iputils` binary on Linux. On macOS, `tracepath` is NOT installed by default — use `traceroute` (BSD-derived, ships with macOS) or install via `brew install iputils`. macOS `traceroute google.com` works without sudo on most modern macOS versions; older releases required sudo for ICMP / UDP probes.
tracepath google.comSame external. For "do all hops respond at all" sanity check: `tracepath -n example.com` is the lightest hammer. If `tracepath` shows `no reply` for ~30 consecutive hops, the destination is unreachable (or every router along the way drops ICMP — common on cloud VPC paths).
Test-NetConnection -ComputerName google.com -TraceRouteNative cmdlet (`Test-NetConnection`, alias `tnc`). `-TraceRoute` enables hop-by-hop output; `-Hops 30` (default 30) caps the trace depth. The output is `TraceRoute` property as a `string[]` of IP addresses. For a richer hop-by-hop trace including per-hop latency, fall back to the system `tracert.exe` invoked from pwsh.
tracert google.com`tracert` is the Windows builtin — uses ICMP echo-request packets (not UDP like Unix `traceroute`). Flags: `-d` no DNS lookups, `-h <count>` max hops (default 30), `-w <ms>` per-hop timeout. `pathping google.com` is the richer variant — combines tracert + ping, gathers per-hop loss statistics over 25 seconds. Slower but more informative.
Worked examples
Trace path to a host
tracepath -n google.comtraceroute google.comTest-NetConnection google.com -TraceRoutetracert google.comDiagnose packet loss per hop
mtr -n google.comTest-NetConnection google.com -TraceRoute -InformationLevel Detailedpathping google.comSkip DNS lookups for faster tracing
tracepath -n google.comtraceroute -n google.comTest-NetConnection google.com -TraceRoute | Select-Object -ExpandProperty TraceRoutetracert -d google.comGotchas
- `tracepath` uses UDP probes; `traceroute` (Unix) defaults to UDP but can be forced to ICMP with `-I`; `tracert` (Windows) uses ICMP. Some routers drop UDP probes but pass ICMP (or vice versa) — if one tool shows all-stars-no-reply and another works, the difference is probe protocol, not connectivity. `traceroute -I` on Linux matches Windows `tracert` behaviour.
- EVERY internet path includes routers that intentionally do NOT respond to traceroute probes (rate-limiting, ICMP filtering, or simply not configured to send TIME-EXCEEDED). Stars-in-the-middle do NOT mean packet loss — they mean that specific router doesn't talk to you. The end-to-end reachability is shown by the FINAL hop succeeding, regardless of middle stars.
- Path-MTU detection (`tracepath`'s special feature) reports the smallest MTU along the path. Common failure mode: a tunnel reduces MTU to 1400 mid-path but the source still sends 1500-byte packets — these get dropped silently if the path also blocks ICMP "fragmentation needed" messages (PMTUD blackhole). `tracepath` SHOWS that 1400 boundary; `traceroute` does not.
- PowerShell `Test-NetConnection -TraceRoute` is much SLOWER than `tracert.exe` for unknown reasons (it appears to wait the full timeout on every hop even when the reply arrives quickly). For interactive use, `tracert -d google.com` from pwsh is faster. For scripted parsing, `Test-NetConnection` is easier because the output is an object.
- Some VPN clients install a default route that captures ALL traffic — your `tracepath` then shows the VPN provider's router as hop 1, not your LAN gateway. Useful debugging hint: if hop 1 of `tracepath 8.8.8.8` is a 10.x.x.x address you don't recognise, check your VPN status.