homeISPdata centre192.168.1.10/24ECHO · TTL 64REPLY · TTL 64ECHO · TTL 64ECHO · TTL 63ECHO · TTL 62ECHO · TTL 61REPLY · TTL 64REPLY · TTL 63REPLY · TTL 62REPLY · TTL 61DNS QUERYA 203.0.113.10SYN :443RST, ACKTTL 1TTL 0TIME EXCEEDEDTTL 2TTL 1TTL 0TIME EXCEEDEDTTL 3TTL 2TTL 1TTL 0TIME EXCEEDEDTTL 4TTL 3TTL 2TTL 1ECHO REPLY
Envelope seal: who sent it (blue laptop, teal routers, green server); the tag shows its type and TTLA probe's TTL drops by one at every router; at 0 it sinks and the router answers Time ExceededPurple bars on the laptop screen: frames recorded by the packet captureThe page will not load, so the laptop checks layer by layer: link, address and gateway, DNS, then the service. Ping proves the gateway and the server answer; a SYN to port 443 gets RST, ACK, so the web server is down. Traceroute's probes with TTL 1, 2, 3 run out at each router in turn, which answers Time Exceeded; TTL 4 reaches the server. The capture shows the real frames. 192.168.1.0/24 is a private home range (RFC 1918); 192.0.2.7, 192.0.2.1, 198.51.100.2 and 203.0.113.10 are RFC 5737 documentation addresses; MACs are RFC 7042 documentation values. Round-trip times are illustrative.

A layered method

  1. The web page will not load. Rather than guess, check one layer at a time from the bottom: the physical link, the IP address and gateway, DNS (names), then the service itself. Each layer needs every layer below it to work.

Ping

Traceroute

Packet capture

Commands and packets, field by field

;; step 1/11 · work-up-layers · local
;; at laptop
symptom: https://www.example.com does not load
check bottom up, stop at the first layer that fails:
  1  Physical link          link light / Wi-Fi joined
  2  IP address + gateway   address, ping the gateway
  3  DNS                    name → address
  4  The service            TCP to port 443
a fault low down breaks everything above it,
so a working higher layer proves the lower ones work

Each router answers from the address of the interface that faces you, so traceroute shows those addresses. Traceroute sends three probes per TTL; the figure shows one. Some routers and servers do not answer ping or traceroute probes at all. A row of * * * or a silent ping only means no answer came back, not that the path is broken.