-W NLearn the path, then watch for changes.
lft -W 5 target:443 turns a trace into a live instrument: per-hop loss, min/avg/max RTT, jitter, a sparkline of RTT history, and — with no -A needed — the ASN, network and organization from Prefix WhoIs. And a path-change detector that alerts only on genuine reroutes.
Four screens saved from one live session of lft -W 5 eggs.gnu.org:587, run from a cloud host in New York. Nothing is mocked or retouched; runs of empty rows are trimmed (⋮). Each capture is followed by notes on what the screen is showing.
- Top band. One candlestick per hop: whiskers span min to max RTT, the bar sits at the average. The millisecond scale on the left is shared across hops so a slow hop stands out at a glance.
- Shaded columns. Hop 3 is a router that never answers; LFT keeps its place in the path and marks it cloaked rather than pretending the path is one hop shorter. The HOP 10–11 column appeared when the path briefly lengthened during the session and was kept so the history stays readable.
- Path line and stats. Under the chart, the hops in order and each one’s min/avg/max. The source hop shows the rotating source port.
- Lower table. Loss, min/avg/max, jitter and the ASN, network and organization from Prefix WhoIs, with no
-Agiven. The rightmost column is a one-minute sparkline;▪is a lost probe. The rising loss at hops 8 and 9 is the exchange point and the target answering fewer of our probes as the session wears on: rate limiting of a persistent prober, which is itself worth knowing about a path. - The banner. The source network load-balances across several first-hop routers. The first time a new address appears at a hop the detector calls it a change; once an address has been seen, alternating back to it is logged quietly as an ECMP shift.
- Bottom bar. Activity spinner, probes received and sent, hop count, health mark, cycle number, interval and target.
2.- Bars are drawn to the average RTT against the millisecond scale on the left; the small
▄marker above each bar is the worst sample seen.*stands in for the cloaked hop. - Hop addresses run along the bottom of the chart. Hops 6 and 7 are the same Boston network at 7 ms; the jump between hops 5 and 6 is the New York to Boston leg.
- The same table follows underneath, so the numbers are never more than a glance away from the picture.
3, then h.- For long paths. The chart gives way to as many rows as the terminal has, with SENT and RECV counts, standard deviation and the last sample added.
- Hostnames replace addresses on
h. Reverse lookups run in the background and fill in as they arrive; here the exchange point, the Boston core routers and the target are all named. Names are clipped to the column, which is why view 1 is the better home for long hostnames.
v in any view; here over view 1.- The drawer slides over the lower half and holds the running trace log: per-hop results as each cycle completes, LFT’s own notices such as neglected hops and sequence anomalies, and a one-line summary per cycle.
- Path events land here too. The last line records the change the banner announced, with the old and new address, so the history survives after the banner clears. Scroll with
jandk;xsaves the whole screen as text and colour ANSI.
A modelled session on the same path, sped up so the detector’s whole life fits in a minute: it learns, arms, logs a flap and an ECMP shift quietly, then flashes a confirmed change.
| HOP | HOST | LOSS% | MIN | AVG | MAX | JIT | ASN | NETNAME | ORGNAME | (newest →) |
|---|
Legend: sparkline green within 20% of the hop average · yellow 20–50% above · magenta over 50% · red lost probe. Source hop uses a documentation-range address. Only the confirmed change flashes the status bar; everything else goes to the log drawer.
Three views, one keyboard
Views on the 1/2/3 keys: an RTT candlestick chart over a rolling statistics table, proportional RTT bars, or a full-height table for long paths. Press h for hostnames, w to hide the whois columns, s to show AS and network seams, v for the log drawer, x to save the screen as .txt and .ansi, +/- to change the interval, p to pause, c to clear and re-learn, q to quit.
Learn first. Alert later.
Path-change detection alerts only on genuine reroutes. It learns first — until the path length holds for three cycles, or eight cycles at most — then requires a changed hop to persist for two observed cycles before it flashes the status bar. A one-cycle change is logged as a flap. A hop alternating among addresses already seen at that TTL is logged as an ECMP shift, not a path change. Path-length changes are noted quietly. Cloaked cycles (*) neither advance nor cancel a pending change, so reroutes behind rate-limited hops still confirm.
Hold the flow. Rotate the port.
Watch cycles stay on one ECMP branch: the TCP source port, UDP IP-ID base and ICMP sequence anchor are held constant within a session, and the source port rotates between cycles so each cycle presents a fresh flow to stateful middleboxes.
After the path stabilizes, topology inheritance narrows the TTL range, widens the in-flight pipeline and tightens timeouts. --no-learn disables it; --learn-margin N sets the TTL margin above the learned length (default 2).