engines

Tracing engines and the options that shape them.

One probe method per trace, chosen by flag; modifiers apply where shown. Click any part of the diagram to build a command — it assembles at the bottom of the page with a plain-English readout.

lft [options] target:portAddress family matched to the target; -4 / -6 force it. Default: TCP to port 443.

probe method — one per trace

(default)TCP

default·SYN probeslft SYN probes; replies correlated by sequence number. Reports [target open], [target closed] or [target filtered]. IPv4 and IPv6.

-b·basicProbes without relying upon sequence numbers being conveyed correctly: more compatible with NAT, slower. May be used with -E. IPv4 only.

-E, -e·adaptiveTries several TCP states — FIN, then SYN-ACK, then SYN — to improve the chances of a trace; reports stateful firewalls and broken IP stacks. Implies -i. Layers on default or -b.

-uUDP

All probes to the same destination port with a pseudorandom session-unique identifier (not the incrementing ports of traditional traceroute), so every probe follows one path.

IPv4 and IPv6

-pICMP

Echo request (ping) probes. Sometimes the fastest; firewalls commonly filter ICMP at network borders.

IPv4 and IPv6

-PRFC 1393

Traceroute Using an IP Option (1993): one ICMP probe, routers reply as it passes. Historical — no router vendor ever implemented it.

IPv4 only

Engine modifiers — change what the probes are or how the engine behaves

-FFIN probes

TCP packets with the FIN flag set, to pass unsophisticated packet filters that don't keep a state table. Not with -E.

applies toTCPUDPICMP1393

-BRealistic TCP options

SYN probes carry a common client option block (MSS, SACK, timestamps, window scale) and realistic sequence numbers, so SYN-normalising firewalls don't drop them.

applies toTCPUDPICMP1393default only

--ecmpECMP members

Varies the source port per probe and sends more probes per hop, exposing load-balanced next hops as a diamond in every output.

applies toTCPUDPICMP1393

-KPath MTU discovery

Probes at the interface MTU and reduces on Packet Too Big; reports [MTU: N] and the limiting hop. IPv6 honors the 1280 floor.

applies toTCPUDPICMP1393

Probe shaping — same engine, different packets or pacing

Ports and sequence

-s sport: fixed source port
-z: one random source port for the whole trace
-d dport: destination port (same as target:port)
-q ISN: initial sequence number
-w window: advertised TCP window (32768)

Pacing and retries

-m min: minimum probes per hop (1)
-M max: maximum probes per hop (2)
-a ahead: hops to query before waiting for replies (5)
-c scatter: minimum ms between probes (20)
-t timeout: maximum RTT before a probe is assumed lost (250)
-j N: N probes per hop for RTT statistics (chart with -o)

Scope and packet

-l min ttl: first TTL to probe (skips close-proximity hops)
-H max ttl: last TTL to probe (caps the path length)
-L length: probe size in bytes (ignored with -K)
-i: ignore ICMP unreachables; continue through firewalls
-I: set the ToS field to minimize-delay

Display modes and views — the same trace, presented differently

Display modes-W N watch: continuous ncurses monitoring every N seconds·--show-seams reveal AS / network seam hops ·-y verify the detected seam by re-probing the boundary hop

Report stylestext (default)·-x XML·-o ASCII diagram·-g / -G GraphViz·--svg·--mermaid·--json / --json-pretty·--geojson·--kml

Names and networks-n numeric·-h symbolic·-A AS numbers (pWhoIs; -R RADB, -C Cymru, -r RIPE RIS)·-N network / AS names

Timing and noise-T execution timers·-U times in UTC·-S no status bar·-V / -VV verbose SENT/RCVD detail·--color / --no-color

Wording follows lft(8). Probe methods are exclusive; modifiers and shaping options combine as noted.

Four engines, exclusive of one another

TCP (default) sends SYN probes, correlates replies by sequence number, and reports the target as open, closed or filtered. UDP sends every probe to the same destination port with a session-unique identifier in the IP ID — not the incrementing ports of classic traceroute — so all probes stay on one ECMP path. ICMP is echo request: sometimes fastest, often filtered at borders. RFC 1393 is the 1993 IP-option method, kept for completeness.

Two ways to change the TCP engine's temperament: basic (-b) stops relying on sequence numbers being conveyed intact, which makes it NAT-tolerant at the cost of speed; adaptive (-E) tries FIN, then SYN-ACK, then SYN, reports stateful firewalls and broken IP stacks, and implies -i so ICMP unreachables do not end the trace.

The effective defaults

Run with no options and this is what you get:

lft -s <dyn> -d 443 -m 1 -M 2 -a 5 -c 20 -t 250 -H 30

Each hop in a one-shot trace uses its own source port from the IANA dynamic range, so a stateful firewall cannot treat the whole trace as one flow and rate-limit it; retries to a silent hop take a fresh port so same-flow duplicate suppression does not hide the hop.

Gateways. Hosts placed between the options and the target form a loose-source-route (LSRR) option list. The public Internet will yield no hops for LSRR — and lft -p 192.168.1.1 target treats 192.168.1.1 as an LSRR hop, not a source. IPv6 rejects LSRR entirely.

targetport -4-6 -S quiet

every flag explained in lft(8) →