Ping works but traceroute fails: 3 network reasons and how to check

Part of our guide on high packet loss low ping

Explore why network security and device settings block traceroute but still allow ping, with clear steps to diagnose.

Difference between ping and traceroute protocols

Ping sends ICMP echo request packets to a target IP address. It awaits replies to measure connection latency and reachability.

Traceroute works by sending packets with increasing TTL (Time To Live) values to map the network path. It often uses UDP packets or ICMP echo requests.

The critical difference is the packet type and how network devices treat them. Ping’s ICMP echo requests are often allowed through firewalls.

Traceroute’s UDP probes or ICMP packets may face blocking or filtering, depending on the network’s security policies and router configurations. Before you commit to anything, it is worth looking at wifi frequency impact on ping.

Traceroute sends packets with increasing TTL values to trigger ICMP Time Exceeded replies from each router along the path. Each hop decrements the TTL until it reaches zero, then returns an ICMP message showing its presence. This helps map intermediate routers, unlike ping which only tests endpoint reachability.

Some traceroute implementations use ICMP echo requests instead of UDP, but many use UDP to high ports rarely open on hosts. This difference affects how routers and firewalls treat the packets, influencing whether traceroute succeeds or times out. Ping solely uses ICMP echo requests and replies, making it simpler and often more allowed.

Why traceroute can be blocked while ping succeeds

Many routers and firewalls permit ICMP echo requests (ping) to pass for basic connectivity checks but block the UDP or ICMP packets used by traceroute. If that sounds like your situation, read up on game ping spikes every 30 seconds next.

Network devices often limit or drop packets with unusual TTL values or UDP destination ports that traceroute uses.

Some internet service providers apply filtering to traceroute traffic to reduce network scanning or abuse, while keeping ping functional.

This selective blocking causes traceroute to fail or show incomplete paths, even if ping replies successfully. We go through lag from bufferbloat during streams step by step elsewhere on the site.

Certain network devices prioritize ping packets over traceroute probes because ping is used for continuous monitoring and troubleshooting. Traceroute packets with unusual port numbers or TTL values may be treated as suspicious or probing attempts and blocked or rate-limited.

Blocking traceroute probes can prevent attackers from mapping network topology. Firewalls may be configured to allow ping for availability checks but drop UDP packets to high ports used by traceroute. This selective blocking can cause traceroute to show missing hops or fail entirely, even though ping works fine.

ISP-level filtering may also block traceroute UDP or ICMP packets to reduce scanning traffic. This filtering usually affects traceroute but not ping, which uses standard ICMP echo requests that must pass for network diagnostics. It helps to understand outgoing packet loss fixes before going further.

How to test and distinguish common causes of traceroute failure

Test traceroute with both UDP and ICMP options if your traceroute tool supports it. Different results help identify what type of packets the network blocks.

Use ping tests to the same IP to confirm basic connectivity and latency.

Try traceroute to a different IP, such as a public DNS server, to see if the issue is specific to a route or network segment. It helps to understand mtu settings router before going further.

Check local firewall or router settings for ICMP or UDP filtering rules that might block traceroute.

Record where traceroute stops or shows stars (*) to identify which hop blocks or ignores probes.

If traceroute fails but ping works, check if your traceroute tool supports forcing ICMP probes instead of UDP. For example, use 'traceroute -I' on Unix/Linux to send ICMP echo requests. Differences in results help reveal if UDP packets are blocked while ICMP passes.

Try running traceroute against a well-known public IP like 8.8.8.8 (Google DNS). If it works there but fails to your target IP, the problem is likely specific to the route or remote network. If it fails everywhere, local firewall or ISP filtering is likely.

Record the last hop number where traceroute shows a response before timing out. This hop is the last device responding to probes. If traceroute shows stars (*) beyond hop 5, the failure is early in the path. Use this to focus investigations.

1. Run ping to confirm the target IP responds.
2. Run traceroute using UDP packets and note results.
3. Run traceroute using ICMP packets if possible.
4. Compare results to determine if packet type causes failure.
5. Inspect local firewalls and router ACLs for blocking rules.
6. Test traceroute to alternative IPs to isolate the problem.

What network devices and settings cause traceroute to fail

Firewalls often block UDP packets on high ports used by traceroute to prevent scanning or attacks.

Some routers silently drop packets with low TTL values or respond only to ping for security.

Enterprise or ISP networks may use deep packet inspection to block traceroute probes selectively.

Home routers sometimes block ICMP or UDP packets by default in their firewall settings.

Network address translation (NAT) devices or VPNs may alter traceroute packets’ behavior, causing them to fail while ping remains unaffected.

Corporate firewalls often block traceroute probes because they use UDP packets to high-numbered destination ports, commonly between 33434 and 33534. These ports are rarely used legitimately and thus blocked to prevent reconnaissance.

Some routers are configured not to send ICMP Time Exceeded messages for expired TTL packets. Without these replies, traceroute cannot map those hops, causing incomplete paths. This is a security measure to obscure internal network structure.

VPNs encapsulate packets and may drop or modify traceroute probes. For example, the VPN gateway might not send ICMP replies for expired TTL packets, making traceroute fail beyond the VPN endpoint while ping still works.

• Firewall blocking: drops traceroute UDP packets
• Router filtering: ignores TTL-expired probes
• ISP policy: blocks traceroute for security
• NAT/VPN alteration: modifies traceroute packets
• Home router settings: disables ICMP or UDP

Why can I ping an IP but not traceroute it

You can ping an IP but not traceroute it because ping’s ICMP echo requests face fewer blocks than traceroute probes.

Traceroute uses packets more likely to be dropped or ignored by network devices for security or performance reasons.

This difference means ping reaches the destination, but traceroute cannot map the path fully or at all.

Understanding this helps you focus on device-level filtering or network policies rather than assuming the host is unreachable.

Troubleshooting traceroute failures reveals which network segment or device blocks path discovery, important when diagnosing game lag or packet loss.

Ping produces a straightforward ICMP echo request which is often treated as harmless by security devices. Traceroute packets, by contrast, try to elicit ICMP Time Exceeded messages from each router, which some devices consider intrusive or potentially abusive.

If network policies block or rate-limit ICMP Time Exceeded or UDP probes, traceroute will fail to get full path data, even though ping receives replies from the final IP.

When traceroute fails but ping does not, it indicates a difference in how intermediate devices handle packets. This helps you pinpoint filtering policies or faulty devices rather than host availability issues.

How GearUP helps identify and fix route issues causing lag

GearUP sends your game’s traffic along better routes using Adaptive Intelligent Routing, which can reduce high ping, packet loss, and jitter.

It tests and selects routes automatically, bypassing problematic network segments that may also cause traceroute failures.

GearUP’s Windows app offers a free trial to test if route issues are causing your lag or packet loss before subscribing.

It targets lag caused by slow or congested routes, not local hardware problems or low FPS.

Using GearUP can save time over manual traceroute troubleshooting by finding better routes quickly.

GearUP monitors multiple possible routes and switches your game traffic to the ones with the lowest latency and packet loss, bypassing segments that might block traceroute probes or cause lag.

It continuously tests routes to your game servers, adapting to network changes that often cause packet loss or increased ping. This dynamic approach avoids static routing issues that traceroute alone cannot resolve.

Because GearUP uses route optimization rather than VPN encryption, it avoids the latency penalties common with VPNs while improving route stability, which traceroute failures often hint at.

• Adaptive routing: picks low-lag paths automatically
• Game-focused: supports over 3,000 games including Valorant and Fortnite
• Platform options: Windows app, mobile apps, and gaming router
• Free trial: test improved routes before subscribing

Questions people still ask

From experience, traceroute failures often hide firewall or router limits, not total breakage.