Network diagnostic tool that goes beyond traceroute: MTU discovery, NAT detection, route flap alerts, IX identification, and more.

ttl traces the path to one or more hosts continuously, keeps per-hop loss, latency and jitter statistics, and flags what it finds along the way. Use it as an interactive TUI, or run it headless with JSON, CSV, text report, streaming JSON, or Prometheus output.

Documentation · Install · Releases · Changelog

cargo install ttl                                # or: brew install ttl
sudo setcap cap_net_raw+ep "$(command -v ttl)"   # Linux; on macOS/BSD run ttl with sudo

ttl 8.8.8.8                          # live TUI; press ? for keys
ttl 8.8.8.8 1.1.1.1 9.9.9.9          # several targets; Tab switches
ttl -p udp --flows 8 cloudflare.com  # ECMP path discovery
ttl 1.1.1.1 -c 100 --report          # 100 rounds, then a text report

Run ttl with no target to open an empty session and add targets with o.

• MTU blackholes in VPNs and tunnels: --pmtud binary-searches the largest packet that reaches the destination. Path MTU Discovery
• Load-balanced paths: -p udp --flows N enumerates ECMP paths and tells per-flow from per-packet balancing. Multi-flow ECMP
• NAT rewriting your flows, including carrier-grade NAT, shown as NAT. NAT Detection
• Rate limiting vs real loss: the RL? title flag and RL loss tag mark routers that throttle ICMP replies rather than drop traffic. Detection Indicators
• Flapping routes: ! marks a hop whose responder changed, kept apart from expected ECMP (E). Route Flap Detection
• Transparent proxies and asymmetric paths: TTL! and ASYM. Detection Indicators
• Who runs each hop: ASN, reverse DNS, GeoIP, and Internet Exchange points from PeeringDB. Enrichment Lookups
• MPLS labels and router interfaces from ICMP extensions (RFC 4950, RFC 5837), marked +. ICMP Extension Details
• Differences between paths: trace several targets, or every address a name resolves to with --resolve-all. Multi-IP Resolution
• Changes over time: save sessions, replay them, and compare two with --diff. Output Formats

For scripts and monitoring, ttl streams line-delimited JSON events, runs as a daemon with a Prometheus /metrics endpoint, and ships as a container image. See the scripting guide.

ttl needs raw-socket privileges: CAP_NET_RAW on Linux, sudo on macOS and the BSDs. The installation guide covers every channel, permissions, shell completions, and download verification.

• Cargo: cargo install ttl (Rust 1.88+)
• Homebrew (macOS, Linux): brew install ttl
• Install script (Linux, macOS): curl -fsSL https://raw.githubusercontent.com/lance0/ttl/master/install.sh | sh (review it first)
• Pre-built binaries: Linux x86_64/ARM64 and macOS from GitHub Releases, with SHA256SUMS
• Docker: docker run --rm -it ghcr.io/lance0/ttl 8.8.8.8
• Distribution packages: Alpine (edge/testing), Arch (AUR ttl-bin), Gentoo, NetBSD pkgsrc, nixpkgs (commands)

*Apple Silicon release binaries are built on the macos-latest runner. On an older macOS, build with cargo install ttl or use Homebrew. **Requires sudo; --interface is not supported. Please report issues.

Limitations and platform caveats are listed in KNOWN_ISSUES.md.

Start with the documentation index, or go directly to your task:

Licensed under either of:

• Apache License, Version 2.0 (LICENSE-APACHE)
• MIT license (LICENSE-MIT)

at your option.