Why does traceroute display many ip addresses for the same hop?

What traceroute give you here as information is that you have at least 2 routes to reach your destination starting from router:

           IP adresses                 Internet operator

           140.0.5.1                   Firstmedia - Indonesia
             /    \
            /      \
221.11.155.65      221.11.165.9        China Unicom - China

This is a normal situation for a huge Internet operator: to have many routes to resist to normal incidents on the Internet.

The -a option of traceroute may help you identify to which operator every IP address belongs.

Here is an example of a larger tree of routes you can get even from your mobile phone through a network tool like server http://ping.eu/traceroute/ : traceroute to 140.0.5.1


From the traceroute(8) manual on OpenBSD:

Three probes (the exact number can be changed using the -q option) are sent and a line is printed showing the TTL or hop limit, address of the gateway, and round trip time of each probe. If the probe answers come from different gateways, the address of each responding system will be printed.

The Linux manual will have similar wording.

The multiple IP addresses that you see are the gateways responding to the individual probes at specific hop limits.

In your case, the three probes resulted in replies that, at hop limit 3, came back to you from the gateways at 221.11.155.65 and at 221.11.165.9.

So, the answer is: No, the packet does not jump between the two hosts listed on that line, there are three probes sent and they take two different routes from 140.0.5.1.


What traceroute does is use the option fields as it sends internet control message protocol (icmp) packets. Each Gateway or routing point in the network reads packets on one interface, decides where they ought to go, and writes them out on another interface. That interface is presumably closer to the destination. While the router is forwarding the packet it also makes modifications to the packet header. It reduces the "time to live" or hop count field by one. Each Gateway in the path of the packet toward the destination decreases this field.

When the hop count field drops to zero, many routers will send back an icmp message saying where the packet was dropped. In order to find which IP address is a specific distance away, traceroute will send packets with the options of time to live & give me a response when it times out. messages with hop counts starting at 1 and ramping way up will each return the IP address of progressively more distant routers. Because traceroute does this multiple times you're going to get back (if you have a richly connected network, as is the internet) multiple answers at some of the counts. it may be the case that a particular Gateway will answer at different amounts away because the route to that gateway went through different hops.