Traceroute Reveals Internet Topology — How to Read Autonomous Systems, IXPs, and Network Boundaries in Your Results

Internet Exchange Points (IXPs) are physical locations where multiple internet service providers and networks connect directly to exchange traffic — and whether your traffic passes through an IXP or travels the "long way" through a major backbone provider's network is often what determines whether a traceroute shows 5 hops or 25 hops between two machines in the same city

The previous articles on this site covered how to read traceroute output, BGP and internet routing, MTR and diagnosing intermittent issues, and ECMP and asymmetric routing. This article addresses traceroute for understanding internet topology — specifically how to identify network boundaries, IXP handoffs, and the points where your traffic transitions from one autonomous system to another.

Autonomous Systems: the building blocks of internet routing

The internet is not one network — it's tens of thousands of networks (Autonomous Systems, or ASes) that each have their own routing policies and exchange traffic with neighbouring networks.

An Autonomous System (AS) has:

• A globally unique AS Number (ASN) assigned by a regional internet registry
• A block of IP addresses (or multiple blocks) that it originates
• Peering and transit agreements with other ASes

Reading ASNs in traceroute: traceroute shows IP addresses at each hop. You can look up the ASN for any IP address using whois or BGP looking glasses. A hop that changes the ASN means the packet crossed a network boundary — transitioning from one organization's infrastructure to another's.

A traceroute from a London home connection to a London-hosted server might show:

1. Your home router (your RFC 1918 private address)
2. Your ISP's edge router (ISP's ASN)
3. Your ISP's aggregation network (same ISP ASN)
4. Your ISP's London PoP (same ISP ASN)
5. An IXP hop — LINX, AMS-IX London, or similar (ASN changes)
6. The hosting provider's edge router (hosting provider ASN)
7. The server (hosting provider's infrastructure)

With a good IXP peering, London-to-London traffic might cross only 2-3 ASes, and the geographical and latency distance is minimal. Without peering, the same traffic might transit through a US-based backbone.

IXPs: where networks exchange traffic directly

An Internet Exchange Point (IXP) is a physical facility with a large switching infrastructure where multiple networks connect and exchange traffic directly — bypassing transit providers (Tier 1 carriers that carry traffic across long distances).

Why IXPs matter for traceroute:

Without IXP peering: traffic between Network A in London and Network B in London might go:

• Network A → Transit provider (e.g., Cogent) → another transit provider → Network B
• This could involve hops in Amsterdam, Frankfurt, or even New York

With IXP peering: traffic between Network A and Network B goes:

• Network A → LINX (London Internet Exchange) → Network B
• 2-3 hops, staying entirely in London, with very low latency

LINX (London Internet Exchange), AMS-IX (Amsterdam), DE-CIX (Frankfurt), Equinix IX (multiple cities), and JPIX (Tokyo) are among the world's largest IXPs. Traceroutes that pass through their subnets will show IP addresses in these IXPs' allocated ranges.

Identifying peering vs transit in a traceroute

Peering: a free (or settlement-free) direct exchange between two networks of roughly equal traffic volume, typically at an IXP.

Transit: a paid relationship where a smaller network pays a larger network to carry its traffic to the rest of the internet.

In a traceroute, distinguishing peering from transit is difficult without additional context, but some indicators:

• A single hop with a large IP address change (from one ASN to a completely different one) typically indicates either a peering point or a transit handoff
• IXP subnets (allocations from regional internet registries specifically for exchange points) can be identified from the hop's IP range
• The latency change at the hop: a peering handoff at an IXP often shows minimal latency increase (a few milliseconds); a transit hop involving geographic distance shows more

TTL exceeded responses and ICMP source addresses

Traceroute works by reading ICMP "TTL Exceeded" responses — when a router discards a packet because its TTL reached zero, it sends this back to the sender. The source IP of the ICMP response is the router's interface that sent it — but not necessarily the interface the packet arrived on.

What this means: some routers send TTL Exceeded messages from a loopback address or management interface rather than the transit interface. The IP shown in traceroute for those hops doesn't correspond to any interface in the path — it's the router's "preferred" source address for ICMP.

Impact on BGP/ASN analysis: if a traceroute hop's IP belongs to a different ASN than you'd expect given the surrounding hops, it may be an out-of-band source address rather than an actual network path change. Look at the broader pattern of surrounding hops, not just a single hop's ASN.

Reading latency accumulation vs per-hop latency

Traceroute RTT (Round-Trip Time) values are cumulative, not per-hop:

Hop 1: 10ms RTT (10ms to hop 1 and back)
Hop 2: 18ms RTT (18ms to hop 2 and back, not 8ms from hop 1 to hop 2)
Hop 3: 15ms RTT (15ms to hop 3 and back)

Hop 3 shows lower RTT than Hop 2 — this is common and not paradoxical. It occurs because:

• Hop 2's router has low priority for ICMP processing — it responds slowly despite being "closer"
• The packet's actual traversal time doesn't match the ICMP response timing
• Or the hop 2 router uses a slow-path for ICMP while forwarding traffic at full speed

Latency should generally increase as hops progress further from the source. A decrease often indicates ICMP processing priority variation, not actual faster routing.

How to use the Traceroute tool on sadiqbd.com

1. For latency diagnosis: focus on where the latency makes a large jump between hops — a 5ms increase per hop is normal; a 50ms increase at a single hop indicates either a geographic crossing or a congested link
2. For network topology understanding: look up the ASN for unusual IPs in the traceroute to identify which network is carrying your traffic at each hop — unexpected ASNs may reveal suboptimal routing
3. For comparing routes to the same destination: run traceroutes from different source points (different ISPs, different geographic locations) to see how routing varies — the same destination may be reached via completely different AS paths depending on where you originate from

Frequently Asked Questions

Why do some traceroute hops show different IPs for each of the three probes at the same TTL? ECMP (Equal-Cost Multi-Path) routing, covered in a previous article, sends different probes along different paths through a multi-path network. If probes 1, 2, and 3 at the same TTL go through different routers (all in the same ASN, all at the same topological distance, but physically different devices), they each receive TTL Exceeded from a different router and show different IPs. This is normal in large network environments and doesn't indicate a problem — it reveals the multi-path structure. Paris traceroute (also covered previously) eliminates this by constraining all probes to the same ECMP path.

Is the Traceroute tool free? Yes — completely free, no sign-up required.

Try the Traceroute tool free at sadiqbd.com — map the network path to any host and see per-hop latency.