Map a Network with Traceroute and Ping

You're staring at a blank terminal, tasked with understanding a remote network before you touch a single port. Poking blindly at IP addresses is slow, noisy, and — for an ethical hacker — a surefire way to trip intrusion detection systems. But there's a smarter way to start: map a network with traceroute and ping. These two humble tools give you a bird's-eye view of the path between you and your target, revealing routers, firewalls, and network topology without sending a single exploit. In this lesson, you'll learn to use them like a pro — to sketch a network's skeleton before you ever scan a port.

The problem this lesson solves

Reconnaissance is the foundation of every ethical hacking engagement, and network mapping is its first pillar. Without it, you're flying blind. Consider the risks of skipping this step:

• Wasted effort: You scan IP ranges that don't exist or belong to someone else, burning time and resources.
• Detection: A blunt force port scan against every host in a large range is loud — firewalls and IDS will log it immediately.
• Missed targets: You can't identify the perimeter routers, load balancers, or internal gateways that are often the most valuable choke points.
• Legal exposure: Scanning outside your authorized scope is not just noisy — it's illegal. Knowing the network structure helps you stay inside the boundaries you're paid to test.

Traceroute and ping solve this by giving you a topology map — a list of hops from your attacker machine to a destination. With a handful of commands, you can identify key infrastructure, measure latency, and infer the routes data takes across the internet or an internal network. This is the difference between stumbling in the dark and walking in with a floor plan.

Core concept / mental model

Think of the internet as a series of interconnected highways. When you send a packet to a remote server, it doesn't teleport — it travels through multiple routers, each acting like an intersection that forwards your data closer to its destination. Each router is a hop.

Ping (Packet Internet Groper) uses ICMP Echo Request messages to test whether a host is reachable and how long a round-trip takes. It's your "is it alive?" check. Traceroute builds on this idea: it sends packets with progressively increasing Time-to-Live (TTL) values. The TTL determines how many routers a packet can pass through before it's discarded. When a router drops a packet due to TTL expiry, it sends back an ICMP Time Exceeded message, revealing its IP address. By incrementing the TTL one hop at a time, traceroute reconstructs the entire route.

In essence: ping tells you if a host is up; traceroute tells you how to get there. Together, they let you map the network's skeleton — the routers and gateways that form its backbone.

How it works step by step

Let's walk through the mechanics, because understanding the protocol makes you a better analyst.

Ping — The Liveness Probe

1. Send an ICMP Echo Request to a target IP or hostname.
2. The target (if alive) replies with an ICMP Echo Reply.
3. Measure the round-trip time (RTT) and packet loss.

That's it. Ping is a one-shot or continuous liveness check. It's perfect for determining if a host is up, but it won't tell you anything about the path.

Traceroute — The Route Mapper

1. Send a packet with TTL=1 to the destination.
2. The first router receives it, decrements TTL to 0, drops it, and sends an ICMP Time Exceeded back.
3. Record that router's IP and the time.
4. Send another packet with TTL=2 — now the second router responds.
5. Repeat until the packet reaches the destination (which replies with an ICMP Echo Reply or a port unreachable, depending on the implementation).

Each step reveals one hop in the route. The result is a list: hop 1, hop 2, ... hop N, with IPs and latency for each.

Important Variations

• Windows uses tracert and sends ICMP Echo Requests.
• Linux/macOS use traceroute and default to UDP packets, but you can switch to ICMP with -I (often required when firewalls block UDP).
• Some routers don't respond to ICMP Time Exceeded — those hops show as * * * (asterisks). That's expected; they're either firewalled or configured to stay silent.

Hands-on walkthrough

Let's put this into practice. Open a terminal on your Linux machine (or WSL on Windows). We'll map a network live.

Step 1: Ping a Known Host

Start with a simple ping to confirm a target is alive and measure baseline latency:

ping -c 4 google.com

Expected output (abbreviated):

PING google.com (142.250.190.46) 56(84) bytes of data.
64 bytes from 142.250.190.46: icmp_seq=1 ttl=116 time=12.3 ms
64 bytes from 142.250.190.46: icmp_seq=2 ttl=116 time=11.9 ms
--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss

Notice the TTL=116 — that's the TTL remaining after the packet traversed multiple routers. The original TTL is often 128 (Windows) or 64 (Linux), so you can estimate the hop count: here, 128 - 116 = 12 hops (or 64 - 116 is negative, so it started at 128). Handy trick!

Step 2: Traceroute to a Remote Host

Now map the route:

traceroute google.com

Expected output (truncated):

 1  192.168.1.1 (192.168.1.1)  1.234 ms  1.145 ms  1.203 ms
 2  10.0.0.1 (10.0.0.1)  5.432 ms  5.120 ms  5.213 ms
 3  203.0.113.10 (203.0.113.10)  10.456 ms  10.221 ms  *
 4  * * *
 5  142.250.190.46 (142.250.190.46)  12.890 ms  12.655 ms  12.744 ms

Each line is a hop. Line 1 is your local router; line 5 is the destination. The asterisks at hop 4 indicate a router that doesn't reply to ICMP Time Exceeded — common in core internet services. The multiple time values are probes sent three times (default behavior) to measure consistency.

Pro tip: If traceroute hangs on UDP, try traceroute -I google.com to use ICMP, which many firewalls allow. On Windows, tracert google.com always uses ICMP.

Step 3: Map an Internal Network

For an internal network, you can map a subnet quickly with a ping sweep (using fping or a loop) to find live hosts, then traceroute to each to understand internal routing:

fping -a -g 192.168.1.0/24 2>/dev/null

This lists all IPs that respond to ping in that range. The -a shows alive hosts, -g generates the range, and stderr is suppressed. You can then traceroute to a few key ones to map internal routers.

Step 4: Combine for a Full Map

Let's write a small Bash loop to trace multiple targets and save results:

#!/bin/bash
for host in server1.local 10.0.0.5 203.0.113.15; do
    echo "=== Traceroute to $host ==="
    traceroute -m 15 -w 2 $host  # max 15 hops, 2 sec timeout
    echo
    ping -c 1 $host | grep 'bytes from'
done > network_map.txt
cat network_map.txt

This script gives you a compact map: for each target, the route and whether it's alive. Save it, and you have a reproducible topology snapshot.

Compare options / when to choose what

Not all mapping methods are equal. Here's a quick comparison:

Key takeaway: For a stealthy, low-noise recon, start with ping for a quick sweep, then traceroute -I for targeted routes. mtr is great for diagnosing where packet loss occurs over time — but it sends continuous probes, so use it only when noise isn't a concern.

Troubleshooting & edge cases

You'll hit these common issues when mapping networks — here's how to handle them.

Firewalls Blocking ICMP

Symptom: Ping returns 100% packet loss, but traceroute still shows hops (because it uses UDP).

Fix: Use traceroute -I to send ICMP if the firewall allows it, or use TCP traceroute: traceroute -T -p 443 google.com — sends SYN packets to port 443, which often gets through.

Hops Showing as * * *

Symptom: Specific hops don't respond, but later hops do.

Cause: Routers that don't return Time Exceeded, or they're rate-limiting ICMP.

Fix: Increase wait time with -w (e.g., -w 3), or use -m to limit hops. Sometimes the route is simply non-linear (e.g., MPLS), so asterisks are normal.

Negative TTL in Ping Output

Symptom: TTL shown is lower than the initial value, sometimes looks odd.

Explanation: The TTL in the reply is the remaining TTL. If you know the initial TTL (128 for Windows, 64 for Linux), you can compute hop count. If TTL is 116, the host is 12 hops away. If it doesn't match expectations, the host's OS initial TTL might be different.

Host Not Responding to Ping at All

Symptom: Ping times out, but traceroute reaches the destination.

Cause: The target filters ICMP Echo Requests, but the route is still valid.

Fix: Use traceroute to confirm the path, and later you might use TCP scans to check if specific ports are open.

Running as Root

Symptom: traceroute fails with "Operation not permitted."

Fix: On some systems, raw sockets require privileges. Run with sudo traceroute ... or use the -w flag with a non-privileged method (some implementations allow unprivileged UDP).

What you learned & what's next

You've mastered the first steps of network recon: you can now map a network with traceroute and ping, identify live hosts, discover routing infrastructure, and estimate hop counts from TTL values. You can handle firewalls that block ICMP, interpret asterisks, and choose the right tool for the job. These skills are fundamental to any ethical hacking engagement — they let you understand a network's layout before you escalate to port scanning.

The natural next lesson in this track is port scanning with Nmap, where you'll take the hosts you discovered and probe them for open services. With a network map in hand, you'll know exactly which IPs to scan, saving time and reducing your footprint. You're building a complete reconnaissance toolkit — one step at a time.