How to read an MTR report
Each row is a router (hop) between our server and your target. Loss% is the share of probes that got no reply, Avg, Best and Worst are round-trip latencies in milliseconds, and StDev shows jitter.
- Real packet loss starts at one hop and continues through every later hop, including the destination.
- Latency jumps that stay high to the end show where delay is added, often at a congested link or a long-distance (for example, intercontinental) hop.
- The last hop is the one that matters. If the destination shows 0% loss and normal latency, the path is healthy even if middle hops look noisy.
MTR for firewall and SASE engineers
Most firewalls can't run MTR themselves, so an outside-in test from the internet is often the fastest way to see where packets are lost on the way to your VPN portal, tunnel peer or security cloud.
MTR on Palo Alto Firewalls: Traceroute and Packet Loss per Hop
PAN-OS has no mtr. Traceroute from the right source and test GlobalProtect and Prisma Access paths.
ZscalerZscaler MTR Test: Trace the Path to ZIA and Zscaler Service Edges
Find your Zscaler service edge, test it over TCP 443 and read loss per hop like ZDX Cloud Path.
FortinetFortiGate MTR & Traceroute: execute traceroute and Packet Loss
execute traceroute-options, ping-options and an outside-in MTR to your FortiGate WAN.
Check PointCheck Point MTR & Traceroute on Gaia: What Works and What to Use
Gaia ships no mtr. Traceroute, asg_tracert on Maestro and an online MTR instead.
Cisco & JuniperMTR on Cisco and Juniper: traceroute monitor, Extended Traceroute and More
Junos traceroute monitor is a real MTR. IOS and ASA need traceroute plus repeated pings.
Any deviceHow to Run MTR on Windows, Linux and macOS (and Read the Report)
mtr, pathping and WinMTR commands, TCP mode, and how to read Loss%, Avg and StDev.
Frequently asked questions
What is MTR?
MTR (My Traceroute) combines traceroute and ping. It sends probes with increasing TTL to find each router on the path, then keeps probing every hop to measure packet loss and latency over time.
Where does the test run from?
From the HardcoreDebug server, not your computer. That gives you an outside view of the path, which helps when you suspect your own network, VPN or proxy.
Why does a middle hop show packet loss but the destination shows 0%?
Many routers rate-limit or deprioritize the ICMP replies sent to traceroute. Loss that appears at one hop and does not continue to later hops is usually not real loss. Only worry about loss that persists all the way to the destination.
When should I use TCP instead of ICMP?
Firewalls often drop ICMP. A TCP test on port 443 or 80 follows the same path real web traffic takes and is more likely to reach the destination.
What do ??? or blank hops mean?
That hop didn't reply to the probe within the timeout. It's common and harmless when later hops respond normally.
Can I use this as a Zscaler MTR test?
Yes. Find your Zscaler service edge with ip.zscaler.com, then run a TCP 443 test to it here and compare with an MTR from the user's device. See the Zscaler MTR guide.
Is there an mtr command on Palo Alto, FortiGate or Check Point?
No. PAN-OS, FortiOS and Check Point Gaia offer traceroute and ping but no mtr. Juniper Junos does, as traceroute monitor. Use this online MTR to test the path to your firewall, VPN portal or tunnel peer from the internet. See our vendor guides.
How do I test a GlobalProtect or Prisma Access connection?
Run a TCP test on port 443 to the portal or gateway hostname, and a UDP test on port 4501 for the IPsec tunnel. Loss that continues to the last hop shows where the problem is.