What I want to do (on a Windows Box) is to traceroute or tracepath using TCP on a specific port.

AFAIK Windows tracert will ONLY use ICMP. But is it possible to use tracert in some manner I am unaware to accomplish this?


In Linux, I believe the following two options would accomplish what I want:

traceroute mail.yourserver.com -p25 -T

The -p25 option tells it to use port 25 as a destination port and the -T tells it to use TCP packets instead of ICMP.



Will send a packet destined for port 443 to and will report back to you at which hop the packet got stuck.

For Windows?

Anyone know of a port of traceroute, or tracepath or some other windows utility to accomplish the same? If there is not an inherent windows solution, is there a 3rd Party solution?

  • I changed the question slightly, because there's a chance there's some undocumented feature in Windows tracert... Also, while this may be a question about software, I'm not sure softwarerecs would be a better choice since this is a very specific aspect about software which only relates to a specific area of networking. It's challenging now that there are so many "stack" sites to know where to post topics that could fall under many categories; for instance superuser could also be a possible posting site.
    – Geo Baj
    Jul 30, 2014 at 6:17
  • 1
    – Jens Link
    Jul 30, 2014 at 7:46
  • @JensLink I will test that later today, would you please make it an answer so that I can mark it as correct (if it works the way I need it to.)
    – Geo Baj
    Jul 30, 2014 at 12:41
  • FYI links to other sites are not answers Jul 30, 2014 at 12:52

2 Answers 2


I finally found a solution for this that works well for me:

TCP Traceroute on Windows And Linux

and for a writeup on how it works:


And here's a copy of one of the simple/typical usage examples:

C:\tracetcp>tracetcp www.redhat.com:443 -h 3

Tracing route to [a184-85-48-112.deploy.akamaitechnologies.com] on
port 443
Over a maximum of 30 hops.
3 32 ms 50 ms 56 ms
4 34 ms 14 ms 33 ms
5 503 ms 14 ms 68 ms
6 43 ms 170 ms 25 ms
7 28 ms 86 ms 26 ms
8 216 ms 168 ms 99 ms
9 * * * Request timed out.
10 Destination Reached in 211 ms. Connection established to
Trace Complete.

You MUST install the winpcap library for this version to work. tracetcp has been tested with version 3.* and 4.* of this library. (Because WinXP SP2 removed raw sockets.) But if you're a network guy, you probably already have winpcap & wireshark already installed anyway.


I think this will not work because TCP ports are L4, which is not used to do the routing. The routers in the middle of the way need only to check up to L3 to make a decision of where to send this packet (unless they`re using PBR), but if the packet was destined to them, they most likely have an ACL dropping lots of packets destined to them (22TCP, 23TCP, 80TCP, etc) if they don't have the right, trusted source. Also all ports that are not used are likely protected by this ACL.

I know that we have ACLs on ingress interfaces but I think most companies that do transit wouldn't overload their routers with ACL because they might receive packets from everywhere. If you are connected to the internet to an ISP that doesn't do transit and your server is located in the same ISP in the same location, then this test might make sense for you.

  • tcptraceroute basically works the same way as any other variant of traceroute. See en.wikipedia.org/wiki/Traceroute for details.
    – Jens Link
    Jul 30, 2014 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.