Skip to content
IPv4 cache refreshed 26 hr ago  ◆  IPv6 cache refreshed 25 hr ago  ◆  Prefixes in table 1,107,739 v4 · 261,906 v6  ◆  Peers 91 v4 · 20 v6  ◆  whois.pwhois.org:43 answering  ◆ 
Prefix WhoIs The Prefix
WhoIs Project
outputs

Same trace. Terminal, SVG, Mermaid, JSON, map.

Text for the terminal, diagrams for the page, JSON for the pipeline, GeoJSON and KML for the map. The trace does not change; the rendering does.

lft -S -E eggs.gnu.org:587
[host]$ lft -S -E eggs.gnu.org:587

TTL LFT trace to eggs.gnu.org (209.51.188.92):587/tcp
 1  192.0.2.1 0/1/1 ±0ms
**  [neglected] no reply packets received from TTLs 2 through 4
 5  nyiix-px.jfk01.twdx.net (198.32.160.208) 2/2/2 ±0ms
 6  bbr02-ae-4-901.bos01.twdx.net (198.160.63.126) 7/7/7 ±0ms
 7  dcr03-hu-0-8-0-0.bsn04.twdx.net (198.160.62.201) 7/7/7 ±0ms
**  [firewall] the next gateway may statefully inspect packets
 8  mass-ix.fsf.org (206.53.143.61) 7/7/7 ±0ms
 9  [target open] eggs.gnu.org (209.51.188.92):587 7.4ms

The default report. Annotations inline with -A/-N; multi-sample hops print min/avg/max ±stddev; the last line is the verdict.

lft --mermaid -E eggs.gnu.org:587
flowchart TB
  n0(["192.0.2.1:50535"]):::source
  n1["192.0.2.254<br/>0.3ms"]:::router
  n2["cloaked<br/><b>TTLs 2-4</b>"]:::hole
  n3["nyiix-px.jfk01.twdx.net<br/>198.32.160.208<br/>1.8ms"]:::router
  n4["bbr02-ae-4-901.bos01.twdx.net<br/>198.160.63.126<br/>7.3ms"]:::router
  n5["dcr03-hu-0-8-0-0.bsn04.twdx.net<br/>198.160.62.201<br/>6.6ms"]:::router
  n6[["mass-ix.fsf.org<br/>206.53.143.61<br/>6.3ms<br/><b>Stateful FW</b>"]]:::fwsmart
  n7(["eggs.gnu.org:587<br/>209.51.188.92<br/>6.4ms<br/><b>open</b>"]):::topen
  n0 --> n1
  n1 --> n2
  n2 --> n3
  n3 --> n4
  n4 --> n5
  n5 --> n6
  n6 --> n7
  classDef source fill:#eef1f5,stroke:#3b424b,stroke-width:1.5px,color:#20262e;
  classDef router fill:#f7f9fc,stroke:#3b424b,stroke-width:1.5px,color:#20262e;
  classDef seam fill:#f1ecfb,stroke:#8b6cd9,stroke-width:2px,color:#20262e;
  classDef fwsmart fill:#eaf1fb,stroke:#4f8fd6,stroke-width:2px,color:#20262e;
  classDef fwstupid fill:#fbeee6,stroke:#d9743a,stroke-width:2px,color:#20262e;
  classDef hole fill:#f4f1ea,stroke:#9aa4b2,stroke-width:1.5px,stroke-dasharray:5 4,color:#5b6472;
  classDef topen fill:#e7f7f1,stroke:#17b890,stroke-width:2px,color:#20262e;
  classDef tclosed fill:#fbf1e2,stroke:#e6a13c,stroke-width:2px,color:#20262e;
  classDef tfiltered fill:#fdeaea,stroke:#e5484d,stroke-width:2px,color:#20262e;
  classDef ecmp fill:#f1ecfb,stroke:#8b6cd9,stroke-width:1.5px,color:#20262e;

A flowchart TB definition with node shapes by role — :::router, :::hole for the cloaked run, [[…]]:::fwsmart for the stateful firewall, ([…]):::topen for an open target. Paste it into a README on GitHub and it renders there; class definitions ship inline so it looks the same everywhere.

Real output from LFT 4.0; the source node uses a documentation-range address.

SVG rendering of a trace to mit.edu:443 from the pwhois.org server, drawn by LFT 4.0

A self-contained SVG: one card per hop, device glyphs embedded as <symbol>s, long hostnames wrapped. Opens in any browser, drops into any document, needs no external files.

$ lft --svg -A -E mit.edu:443 > trace.svg

Drawn by LFT 4.0 on the pwhois.org server: two cloaked runs, a Tata hop, and an open Akamai edge. The source card carries a documentation-range address.

The glyph set

source
source
router
router
cloaked
cloaked
AS seam
AS seam
stateful FW
stateful FW
flag FW
flag FW
target open
target open
target closed
target closed
filtered
filtered
lft --json-pretty (shape)
{
  "schema": "lft-trace", "schema_version": 1,
  "generator": "lft 4.0",
  "source": { "address": "192.0.2.1", "port": 50535 },
  "target": { "host": "eggs.gnu.org", "address": "209.51.188.92", "port": 587, "protocol": "tcp" },
  "result": { "status": "open" },
  "hops": [
    { "ttl": 1, "responders": [ { "address": "192.0.2.1", "rtt_ms": { "min": 0.4, "avg": 0.7, "max": 1.1 } } ], "firewall": null },
    { "ttl": 2, "responders": [], "firewall": null },
    …
    { "ttl": 8, "responders": [ { "address": "206.53.143.61", "hostname": "mass-ix.fsf.org", "asn": 22989, … } ], "firewall": "stateful" }
  ]
}

The lft-trace document: run metadata, source, target, result, and one object per TTL with every responder's ASN, network name and RTT statistics. Every key is always present; silent TTLs and ECMP members are explicit; compact mode is NDJSON-safe, so appending runs to a file just works.

$ lft --json -A www.example.com:443 | jq '[.hops[].responders[].asn | select(.)] | unique'
"Within a schema version, keys are never removed or renamed and enumerations only gain values."

Shape shown; field names follow the documented schema. Pipe with confidence.

-o draws a horizontal hop diagram — one column per hop with hostname, address, ASN, network, RTT and a feature line (⇶ Stateful FW, ⚑ Flag FW, ╳ ASN Seam, ░cloaked░, [OPEN]), Unicode and color auto-detected, NO_COLOR honoured, --color/--no-color to force. -j N adds a candlestick RTT chart above it and flags hops with more than 25 ms of jitter.

$ lft -o -j 5 -A www.example.com:443

--geojson (RFC 7946) and --kml (OGC KML 2.2) put located hops and great-circle segments on a map, with city, region, country, per-segment distance, RTT delta and AS change. A hop whose RTT is faster than light for its distance is kept but flagged as implausibly located — faster than light is a geolocation bug, and we say so.

$ lft --kml --geo-color rtt www.example.com:443 > path.kml $ lft --geojson www.example.com:443 > path.geojson

--geo-color rtt colours segments green-to-red by latency; --geo-width and --geo-arc style the path. Geolocation comes from Prefix WhoIs, so -A is implied. IPv6 hops are not located.

-x is a versioned XML event stream (schema="lft-xml" schema_version="1") with host and network names escaped and sport/dport/rtt attributes. Parse by event code, not position.

$ lft -x -A www.example.com:443
ON THE TERMINAL

text·-o·-j·-x

The report you read, the diagram you scan, the chart that shows jitter, the event stream you parse.

ON THE PAGE

--svg·--mermaid·-g

Diagrams for documents and repos. All three draw ECMP diamonds with --ecmp and mark seams with --show-seams.

IN THE PIPELINE & ON THE MAP

--json·--geojson·--kml

Schema-versioned data for dashboards; RFC 7946 and KML 2.2 for any map viewer.