How to Track Where Your Internet Latency Spikes Using Ping and Traceroute

Your connection feels fine most of the time. Then suddenly a video call breaks up, an online game stutters, or a webpage takes five seconds to load when it usually takes one. You refresh. It is fine again. The problem disappears before you can figure out where it came from.

Latency spikes are one of the most frustrating network problems precisely because they are intermittent. The speed test passes. Everything looks normal. But something between your computer and the destination is occasionally failing, and you have no idea where.

Ping and traceroute are the two tools built into every operating system that answer this question. They do not require any software installation and they work in minutes. Here is how to use them properly.

Understanding What You Are Looking For

Before running any commands, it helps to understand what latency actually is and what a spike means.

Latency is the time it takes for data to travel from your device to a destination and back again. It is measured in milliseconds. A round trip of 20ms means data left your computer, reached the destination, and returned in twenty milliseconds. This is fast. A round trip of 300ms feels sluggish in real-time applications. A spike to 1,000ms causes a visible freeze.

The internet between your computer and any destination is not a direct connection. Data travels through a series of routers and network devices, each called a hop. Your data goes through your router, then your ISP's equipment, then backbone network infrastructure, then finally to the destination. Each hop adds a small amount of latency. If one hop in the chain is congested, failing, or misconfigured, latency spikes starting from that point affect everything beyond it.

The goal of this diagnostic process is to identify exactly which hop is responsible.

Step 1: Start With Ping to Confirm the Problem

Ping sends small test packets to a destination and measures how long each one takes to return. It tells you two things: whether the destination is reachable, and whether your latency is consistent or spiking.

Running Ping on Windows

Open Command Prompt by pressing Windows key, typing cmd, and hitting Enter. Then type:

ping -t google.com

The -t flag makes ping run continuously rather than stopping after four packets. Let it run for at least two to three minutes. You are watching for two things: how high the times are and whether they are consistent.

A normal result looks like this:

Reply from 142.250.80.46: bytes=32 time=14ms TTL=115
Reply from 142.250.80.46: bytes=32 time=13ms TTL=115
Reply from 142.250.80.46: bytes=32 time=15ms TTL=115

Stable times close together means no problem at this destination. A result with spikes looks like this:

Reply from 142.250.80.46: bytes=32 time=14ms TTL=115
Reply from 142.250.80.46: bytes=32 time=287ms TTL=115
Reply from 142.250.80.46: bytes=32 time=13ms TTL=115
Request timed out.
Reply from 142.250.80.46: bytes=32 time=15ms TTL=115

That 287ms spike and the timed out reply confirm something is wrong somewhere between you and Google. Press Ctrl and C to stop ping when you have enough data.

Running Ping on macOS or Linux

Open Terminal and type:

ping google.com

On macOS and Linux, ping runs continuously by default. Press Ctrl and C to stop it and see the summary statistics at the end, which show minimum, average, maximum, and standard deviation of all round trip times.

What to Ping First

Always start by pinging your own router before testing external destinations. Find your router's IP address by opening Command Prompt and typing ipconfig on Windows, or typing ifconfig or ip route in Terminal on macOS and Linux. The Default Gateway address is your router.

Ping that address first:

ping 192.168.1.1

If your router responds with stable low latency of 1 to 5ms and no spikes, your local network is healthy. The problem is somewhere beyond your router. If your router shows spikes or timeouts, the problem is in your own network or hardware and can be fixed locally.

Step 2: Use Traceroute to Find the Exact Hop

Ping tells you that a problem exists. Traceroute tells you where. It maps every hop between your computer and the destination, showing the latency at each one.

Running Traceroute on Windows

Open Command Prompt and type:

tracert google.com

Note the spelling. On Windows the command is tracert, not traceroute. The results take a minute or two to complete as the tool probes each hop one by one.

Running Traceroute on macOS or Linux

Open Terminal and type:

traceroute google.com

Reading the Output

The output looks like this:

Tracing route to google.com [142.250.80.46]

 1     1 ms     1 ms     1 ms  192.168.1.1
 2     5 ms     5 ms     6 ms  10.0.0.1
 3    12 ms    11 ms    12 ms  isp-router.net
 4    13 ms    14 ms    12 ms  72.14.203.65
 5   250 ms   248 ms   255 ms  backbone-router.net
 6   251 ms   249 ms   254 ms  142.250.80.46

Each line is one hop. The three time values are three separate test packets sent to that hop, all in milliseconds. The IP address or hostname at the end identifies which router responded.

Reading this example: hops 1 through 4 show healthy low latency in the 1 to 14ms range. Hop 5 suddenly jumps to 250ms and stays elevated at hop 6. This is a clear signature. The problem started at hop 5. Everything before it was fine. Everything after it inherited the high latency.

This tells you exactly where the problem is. Hop 5 in this example belongs to a backbone network between your ISP and Google. You can search the hostname or IP address to identify which company operates that network segment.

What the Three Asterisks Mean

You will often see hops that display asterisks instead of times:

 3     * * *     Request timed out.

This does not always mean something is broken. Many routers are configured to ignore traceroute probes as a security measure or to prioritise forwarding real traffic over responding to diagnostics. If the asterisks appear at a middle hop but subsequent hops show normal latency, those routers are simply not responding to probes. The data is still flowing through them normally.

Asterisks only indicate a genuine problem when they appear at the final hop and you cannot reach the destination, or when all hops after a certain point also show asterisks alongside confirmed latency spikes from the ping results.

Step 3: Narrow Down Whose Problem It Is

Once traceroute identifies the hop where latency spikes begin, you need to determine whether the problem is yours to fix or someone else's.

Hop 1 is your router. Spikes at hop 1 indicate a local problem. Check your ethernet cable, try rebooting your router, or test whether the problem exists on both wired and wireless connections. A wired connection that shows hop 1 spikes while a wireless connection does not suggests a cable or switch issue. Both showing the same spike points to the router itself.

Hops 2 and 3 are typically your ISP's equipment. Consistent spikes starting here and persisting through all subsequent hops are a sign of a problem your ISP needs to investigate. This is where the data from your ping and traceroute becomes evidence you can share with them.

Later hops belong to backbone networks or the destination's infrastructure. Problems starting at hop 5 or beyond that persist through to the destination are usually outside your ISP's control. They are congestion or routing issues in the wider internet infrastructure. These often resolve on their own as routing tables update or congestion clears.

Step 4: Use WinMTR for Continuous Monitoring on Windows

Ping and traceroute give you a snapshot. For intermittent problems that come and go, a tool called WinMTR is significantly more useful because it combines both tools and runs continuously.

WinMTR is free and available at winmtr.net. Download and run it, type your destination in the Host field, and click Start. It runs ping and traceroute simultaneously and accumulates statistics over time, showing you the packet loss percentage and average latency at every hop.

After letting it run for five to ten minutes during a period when you are experiencing the problem, you get a table showing exactly which hop has the highest packet loss or most variable latency. This is much more convincing evidence than a single traceroute snapshot, both for your own understanding and for sharing with your ISP if needed.

When contacting your ISP about latency spikes, export the WinMTR results using the Copy Text to Clipboard button and include them in your support ticket. A specific statement like "hop 3 at 10.0.0.1 shows 8 percent packet loss between 7pm and 9pm" gets a faster and more useful response than "my internet is slow sometimes."

Interpreting Latency Numbers

Knowing what normal looks like prevents unnecessary concern about results that are actually fine.

Latency of 1 to 5ms at hop 1 is your router and should always be in this range. Latency of 5 to 30ms at hops 2 and 3 represents your ISP and is healthy. numbers around of 30 to 80ms for destinations within the same country is normal. above 150ms to domestic destinations suggests a problem.

A latency increase of 20 to 30ms between consecutive hops is not a problem. It is simply the physical time required for data to travel between those two points. A jump of 100ms or more that persists through all subsequent hops is significant and worth investigating.

Latency that spikes and then returns to normal at the same hop, while subsequent hops show no elevated latency, is almost always a router deprioritising traceroute probe responses rather than a real problem. As long as the final destination responds with normal latency, the intermediate asterisks or elevated hops are harmless.

Frequently Asked Questions

Can I run these tools on Windows without installing anything?

Yes. Both ping and tracert are built into Windows and available in Command Prompt without any installation. For more detailed continuous monitoring, WinMTR is a free download that requires no installation and runs directly as an executable.

My traceroute shows asterisks at every hop after my router. What does this mean?

This usually means the destination is blocking traceroute probes. Some servers and networks filter ICMP packets for security reasons. If you can still successfully reach the website or service in your browser, the connection is working and the asterisks are simply the server refusing to respond to diagnostic probes.

How do I find out which company owns the IP address causing my latency spike?

Copy the IP address from the traceroute output and go to who.is or arin.net and paste it into the search field. The results show which organisation owns that IP address range and contact information. This tells you whether the problem is inside your ISP's network, in a transit provider's network, or at the destination itself.