PDF

About Traceroute

Updated: April 15, 2026

Want to summarize with AI?

Log in

Describes how traceroute enables users to discover the actual network path packets take to their destination. Provides insight into connectivity and troubleshooting by revealing hop-by-hop details and identifying points of failure.

The traceroute tool is a network utility that discovers the route packets take to their destination, showing each hop and its associated time stamp.

  • Identifies the path taken on a hop-by-hop basis.

  • Includes a time stamp at each hop in both directions.

  • Helps test connectivity and traces the path up to the point of failure if the destination cannot be reached.

Traceroute Modes and Path Discovery

Traceroute supports several operational modes and provides detailed path discovery across the network fabric.

  • Endpoint-to-endpoint

  • Leaf-to-leaf (tunnel endpoint, or TEP to TEP)

  • Endpoint-to-external-IP

  • External-IP-to-endpoint

  • External-IP-to-external-IP

When traceroute is initiated from tenant endpoints, the default gateway appears as an intermediate hop at the ingress leaf switch.

  • Discovers all paths across the fabric.

  • Discovers point of exits for external endpoints.

  • Helps detect if any path is blocked.

Restrictions for traceroute configuration

When configuring traceroute, consider the following restrictions:

  • When the traceroute source or destination is an endpoint, the endpoint must be dynamic and not static. Unlike a dynamic endpoint (fv:CEp), a static endpoint (fv:StCEp) does not have a child object (fv:RsCEpToPathEp) that is required for traceroute.

  • Traceroute works for IPv6 source and destinations but configuring source and destination IP addresses across IPv4 and IPv6 addresses is not allowed.

  • See the Verified Scalability Guide for Cisco ACI document for traceroute-related limits.

  • When an endpoint moves from one ToR switch to a different ToR switch that has a new MAC address (one that is different than the MAC address that you specified while configuring the traceroute policy), the traceroute policy shows "missing-target" for the endpoint. In this scenario you must configure a new traceroute policy with the new MAC address.

  • When performing a traceroute for a flow involving the policy-based redirect feature, the IP address used by the leaf switch to source the time-to-live (TTL) expired message when the packet goes from the service device to the leaf switch may not always be the IP address of the bridge domain's switch virtual interface (SVI) of the service device. This behavior is cosmetic and does not indicate that the traffic is not taking the expected path.

  • Starting with APIC release 6.1(4), itraceroute supports destination ports located behind remote leaf edge ports. Instead of showing each hop, it displays reachability information.

Perform a traceroute between endpoints

Follow these steps to perform a traceroute between endpoints:

Procedure

  1. In the menu bar, click Tenants.

  2. In the submenu bar, click the tenant that contains the source endpoint.

  3. In the Navigation pane, expand the tenant and expand Policies > Troubleshoot.

  4. Under Troubleshoot, right-click on one of the following traceroute policies:

    • Endpoint-to-Endpoint Traceroute Policies and choose Create Endpoint-to-Endpoint Traceroute Policy

    • Endpoint-to-External-IP Traceroute Policies and choose Create Endpoint-to-External-IP Traceroute Policy

    • External-IP-to-Endpoint Traceroute Policies and choose Create External-IP-to-Endpoint Traceroute Policy

    • External-IP-to-External-IP Traceroute Policies and choose Create External-IP-to-External-IP Traceroute Policy

  5. Enter the appropriate values in the dialog box fields and click Submit.

    Note

    For the description of a field, click the help icon (?) in the top-right corner of the dialog box.

  6. In the Navigation pane or the Traceroute Policies table, click the traceroute policy.

    The traceroute policy is displayed in the Work pane.

  7. In the Work pane, click the Operational tab, click the Source Endpoints tab, and click the Results tab.

  8. In the Traceroute Results table, verify the path or paths that were used in the trace.

    Note

    • More than one path might have been traversed from the source node to the destination node.

    • For readability, you can increase the width of one or more columns, such as the Name column.

The traceroute results display the network path or paths traversed between the source and destination endpoints.