Featured Freeware: MTR

Posted on by Jay Allen | Updated:
Category: Technical Support | Tags: , , ,

Featured Freeware highlights some of the Liquid Web staff’s favorite free software. This week we are covering a treasured favorite, MTR.

Note: This post assumes you have a working knowledge of traceroute.

MTR (originally Matt’s Traceroute, now My Traceroute) functions like traceroute insofar as it displays the network hops from your local machine (or server, depending on where you run the command) to the target IP address or hostname.

But MTR differs from traceroute by constantly observing and displaying the network hops and related statistics instead of displaying a single set of results. Put simply, if you traceroute to google.com you will get a report for a single connection from your computer to Google’s servers. If you MTR to google.com you will see a continuously updated display of each hop and its performance over time until you tell it to stop. Response times can be evaluated just like traceroute or ping results: Higher numbers are bad, lower numbers are good. If a particular hop is showing much higher response times than the others, even without packet loss, you can see that it might be having a problem.

MTR can be installed on almost any Linux machine by using a local package manager such as yum or apt. Windows and Mac OS X users can install MTR using the links in the Additional Resources section at the bottom of this post.

Basic MTR Usage

Example MTR command from a Liquid Web server to google.com:

[root@host]# mtr google.com

My traceroute [v0.85]
host.example.com (0.0.0.0)Wed Mar 23 14:58:34 2016
Keys: Help Display mode Restart statistics Order of fields quit
 PacketsPings
HostLoss%SntLastAvgBestWrstStDev
1. 111.111.111.1110.0%4611.11.11.014.90.7
2. router.example.com0.0%4611.12.01.0156.20.6
3. router2.example.com0.0%4611.110.70.9197.332.2
4. border.example.com0.0%46129.232.27.1271.538.6
5. eqix-ch-100g.google.com0.0%4609.07.67.128.30.4
6. 209.85.143.1520.0%4607.38.27.330.72.3
7. 216.239.51.2250.0%4607.37.67.325.61.5
8. ord31s21-in-f14.1e100.net0.0%4607.37.67.220.51.5
Note: This represents a static screen from an MTR result, but when run in this manner MTR will continuously update these stats until you cancel it with CTRL+C or q. Alternatively, if you really want a static report instead of a realtime analysis, you can use mtr with the –report flag to generate a summary report: “mtr –report google.com”

Breaking the results down from left to right:

  • Host: The name or IP address of the network hop.
  • Loss%: The percentage of packets that are being lost during the trace. In most cases, this is the first result you want to watch.
  • Snt: The number of packets sent to the hop.
  • Last: The response time of the last packet sent to the hop.
  • Avg: The average response time during the entire span of the test.
  • Best: The best response time during the entire span of the test.
  • Wrst: The worst response time during the entire span of the test.
  • StDev: Is the Standard Deviation of latencies to the host, and can help you better evaluate the average latency measurement. A high StDev indicates an inconsistency in the latency measurements on that hop, such as when a wide gap is recorded between the best and worst latencies on that hop.

Evaluating MTR Results

Almost immediately you will want to pay attention to the Loss% column in MTR’s display. As the tests progress, the percentage will get more accurate at telling you where there may be a problem. Generally speaking, you will see packet loss at every hop past the point of trouble if a network issue is in play, and the point in the route at which the packet loss occurs will narrow down the nature of the specific issue.

  • Depending on your home or office network setup, the first hops likely will be your local firewall and/or router or wireless access point. If the packet loss is occurring in one of these first couple of hops, it could be an indicator of trouble within your local network. You may want to try temporarily disabling the firewall or antivirus suite on your computer and checking the route (and the site) again.
  • The next hop likely will be your Internet Service Provider’s network, and you may recognize your ISP’s name in the host column. If the packet loss is here, then you have a strong indicator that your ISP is having problems on their end. Do other websites load properly, or is everything slow?
  • Packet loss in the middle of the route can be an indication of a problem with a major Internet route. In this case, you can notify your ISP and they can potentially contact their upstream provider to get the matter resolved. It is important to note, however, that some packet loss at this stage is normal: You can almost always expect to see minor packet loss when the server is physically located in a different geographic region or across a large body of water, such as an ocean. The amount of packet loss typically will increase with distance. If the route continues past this point and ultimately connects to the server, there may be not be a network issue. To confirm, you can test the route to the site from a server in the same geographic region as your server using a free tool such as Traceroute Tools Online or through a free VPN service. If there are no issues, you may want to consider using a Content Delivery Network to ensure that the bulk of your site’s resources are served from the locations closest to your site visitors.
  • Finally, the route will pass through your hosting provider’s router and firewall to reach their internal network, and then through your server’s firewall (which may be a cloud firewall, a hardware firewall, a software firewall, or a combination of the three). If you’re a Liquid Web customer, follow the instructions in our article at Unblocking an IP Address in the Firewall or use our semi-automated IP address unblock tool in Manage to ensure that your IP address is not being blocked in your server’s firewall.

Additional Resources