How to Use Nmap for Traceroute and Read the Network Path

To use Nmap for traceroute, run nmap -sn --traceroute scanme.nmap.org. The -sn option skips port scanning while Nmap checks whether the host is up; --traceroute asks it to show the route to a responding host. Replace the sample host only with a system you own, administer, or have permission to scan. This path-only command keeps the test narrower than Nmap’s default port scan.

What Nmap traceroute shows

A traceroute estimates the network path by sending packets with different IP time-to-live (TTL) or hop-limit values. Each router reduces that value; when it reaches zero, a router may return an ICMP “Time Exceeded” message. The scanning tool uses those replies to identify hops and measure round-trip time (RTT). TTL counts hops, not seconds.

Nmap’s method differs from the classic traceroute or Windows tracert. Nmap performs traceroute after its scan and uses scan results to select a port and protocol likely to reach the target. It starts with a high TTL and counts downward, while many traditional traceroute tools start at one and count up. As a result, Nmap’s route output is tied to the scan and probes it made; it is not a complete map of every possible route or the return path.

Run an Nmap traceroute in four steps

1. Install Nmap and check that it runs

Get Nmap from the official Nmap download page. Choose the installer for Windows or macOS, or follow the official installation guidance for your Linux distribution. Open Command Prompt, PowerShell, Terminal, or a Linux shell and enter nmap --version. If the command is not found, complete installation or add Nmap to your command path.

Some scan and traceroute functions need elevated packet-capture or raw-socket privileges. On macOS or Linux, try prefixing the command with sudo if Nmap reports a permissions problem; on Windows, open the terminal with administrator rights when required. Use only the privilege level needed for your authorized test.

2. Pick a host you are allowed to test

For a safe practice target, the Nmap project explicitly permits Nmap scans of scanme.nmap.org. That permission is limited: do not test exploits or run denial-of-service tests, and keep scans to no more than a dozen per day. For other hosts, get the network owner’s approval first. The project’s Nmap legal and usage guidance explains the scope of its test host and why scanning permissions matter.

3. Start with a path-only command

Run this command on macOS or Linux:

sudo nmap -sn --traceroute scanme.nmap.org

On Windows, omit sudo and use an elevated terminal if needed:

nmap -sn --traceroute scanme.nmap.org

The Nmap host-discovery reference documents both options. Nmap still sends network probes; -sn means “no port scan,” not “no traffic.” If you need to investigate a particular service instead, use a narrowly scoped port scan against an authorized host, such as nmap -p 443 --traceroute your-authorized-host.example. This checks TCP port 443 before tracing and can send more traffic than the path-only command.

4. Read the hop list and save it if useful

Look for the TRACEROUTE section and its HOP, RTT, and ADDRESS columns. A hop number marks the observed position along the route. RTT is the time for a probe to reach that hop and for a reply to return; it is not a one-way measurement or a direct measurement of the link alone. Addresses may be shown as IP numbers or, when name resolution succeeds, hostnames.

To keep a normal-text copy for comparison, add Nmap’s output option:

sudo nmap -sn --traceroute -oN nmap-trace.txt scanme.nmap.org

Run the same command from the same source network when comparing results. A changed route can reflect routing changes, load balancing, or temporary filtering rather than a fault by itself.

Troubleshoot missing or confusing hops

• An asterisk appears: * * * means Nmap did not receive a usable reply for that probe before its timeout. A router may filter or rate-limit responses and still forward traffic, so one silent hop does not prove the path is broken.
• The trace does not start: Confirm the hostname resolves, that the destination responds to discovery probes, and that you have the required privileges. If you control the target, check its firewall and the network rules between it and your scanner.
• Names slow the display: Add -n to skip reverse-DNS lookups, for example sudo nmap -n -sn --traceroute scanme.nmap.org.
• Latency jumps at one hop: Treat it as a clue, not proof of congestion at that router. ICMP replies can be delayed or deprioritized, and the outward and return routes may differ.

Nmap’s --traceroute is useful when you want path information alongside host-discovery or port-scan results. Read the hop list as evidence from one source, at one time, using particular probes. Firewalls, load balancing, and asymmetric routing can all hide or alter parts of the picture.