Time Exceeded

In short: An ICMP error message triggered when a packet’s time to live (TTL) drops to 0 before it has reached its destination.

In more detail: Every IP packet starts with a TTL that is reduced by 1 at every router it passes — this prevents misrouted packets from circling endlessly in the network. The traceroute tool deliberately exploits this mechanism: it sends packets with an artificially low TTL in order to make every single router on the way to the destination visible through the time exceeded messages that come back.

In Depth

The principle behind traceroute/tracert is both clever and simple: the tool first sends a packet with TTL=1 — the very first router along the way reduces the TTL to 0, discards the packet and sends back a time exceeded message with its own IP address. That makes hop 1 known. Then traceroute sends a packet with TTL=2 — it arrives at the second router with TTL=0, which reports back, and so on until the target system is reached (which then sends a different reply instead of time exceeded, e.g. port unreachable or a normal echo reply).

In this way, a complete list of all routers on the way to the destination is created step by step — including the response time per hop, which in troubleshooting makes visible at which point in the network a delay or failure occurs. Some routers/firewalls filter out time exceeded messages for security reasons, which then shows up in the traceroute output as a “timeout” or asterisks (* * *) instead of a real IP address.

See also: ICMP types, Destination Unreachable