How to Use Trippy: The Beginner's Guide (First Trace, the Privilege Lesson, ECMP Modes, and Reading the Output)

CodexFuse Team · 2026-11-01T23:36:46.437Z · 17 min read min read

Trippy combines traceroute and ping in one live terminal UI. This beginner's guide covers installing it, running the trip command, the privilege lesson, ECMP modes, and reading the output.

How to Use Trippy: The Beginner's Guide (First Trace, the Privilege Lesson, ECMP Modes, and Reading the Output)

If you search "how to use trippy" you mostly get classic traceroute guides and a single product setup page — nobody has written the from-zero beginner walkthrough. This trippy tutorial is that missing guide. Trippy is a network path tracing tool that combines the functionality of traceroute and ping into one live terminal interface, so instead of running traceroute over and over and squinting at static snapshots, you watch every hop update in real time. The whole thing is one sitting of work: install the package, run the trip command against a target, sort out the one privilege lesson, and learn to read the screen. Most network diagnostics you will ever run from a server happen on a VPS, and our VPS hosting guide is the base this guide assumes.

The mental model is the whole tool, so learn it once: Trippy is traceroute plus ping in ONE live TUI — the successor to mtr. It discovers the path exactly like traceroute does, then keeps probing every hop continuously like ping does, turning the results into per-hop latency statistics, RTT history charts, and loss percentages on a screen that refreshes itself. One naming quirk to clear up immediately, said once: the package is called trippy, but the command you type is trip. You install trippy and you run trip.

What Is Trippy, Exactly?

Trippy is a free, open-source network path tracing tool written in Rust that combines the functionality of traceroute and ping into a single live terminal user interface. It discovers the routers between you and a target exactly like traceroute does, then keeps probing them continuously like ping does, showing per-hop latency, packet loss, and route changes on one screen that updates in real time. If traceroute is a photograph of the road and ping is a stopwatch, Trippy is a live dashboard of the whole journey.

The current stable release is 0.13.0, published in May 2025, and the project is distributed under the Apache License 2.0 — free for personal and commercial use. In its own words, the project "draws heavily from mtr" and incorporates ideas from both libparistraceroute and Dublin Traceroute, which is why it feels instantly familiar if you have ever used mtr, and instantly better the moment the charts start moving.

How Does Trippy Actually Trace a Path?

Trippy sends packets with increasing TTL values and listens for the ICMP "time exceeded" replies each router sends back — the same trick classic traceroute has used for decades. Every IP packet carries a Time To Live field that each router decrements by one; when it hits zero, the router discards the packet and tells the sender about it, which reveals that router's address. If you want the full background on the fields involved, our guide to how IP addresses and TTL work covers it.

The difference is what happens next. Where traceroute takes one snapshot and exits, Trippy runs continuous rounds — one full sweep of every hop per round, about one second per round by default — and accumulates statistics: how many probes were sent, how many answered, and the minimum, average, best, worst, and standard deviation of the round-trip times. That accumulation is what turns a path trace from a guess into evidence: one slow reply is noise, but a hop that loses 5% of probes for ten minutes is a fact you can act on.

By default Trippy probes with ICMP, the same protocol ping uses. You can switch to UDP or TCP with a flag, which matters when a firewall on the path treats ICMP differently from real traffic — more on that in the protocol notes below.

How Do You Install Trippy?

You install the trippy package from your platform's official source, and from then on you run the trip command — install once, trace forever. The project maintains an official install matrix, and the commands below were verified against it at the time of writing.

Prebuilt binaries for Linux, macOS, Windows, FreeBSD, and NetBSD are also published with every release on the project's GitHub releases page, which is the fastest route on a minimal server with no package manager to spare. Confirm the install worked by running the trip command with no arguments: you should see the usage line Usage: trip [OPTIONS] [TARGETS]..., which is your proof the binary is on your PATH.

How Do You Run Your First Trace?

Your first trace is five steps, and the whole arc takes about a minute. Run it elevated the first time — the privilege lesson below explains why — so nothing distracts you from learning the screen.

1. Open a terminal on Linux, macOS, or Windows.
2. Run sudo trip example.com. The TUI opens and the hops table starts filling in within seconds.
3. Read the table left to right: hop number, hostname, loss percentage, probes sent and received, then the RTT columns (last, average, best, worst, standard deviation).
4. Press t to toggle the per-hop RTT history chart at the bottom, and use the up and down arrows (or j/k) to move the selection between hops.
5. Press Space to freeze the display and study a moment, and q to quit when you are done.

That is the whole first session. The screen has four regions worth knowing: the hops table up top, the sample-history RTT chart that draws one line per selected hop, a frequency-distribution histogram of RTT values, and — once you add a GeoIP database — an interactive world map. The information bar along the bottom always tells you the truth about your session: the address family and protocol (for example IPv4/ICMP), whether you are running privileged or unprivileged, the locale, and the current display mode.

A few more keys you will use constantly: c toggles which columns are visible, g toggles the GeoIP map, f filters to a single flow, r resets all statistics, and s opens the settings dialog. The default column set is deliberately restrained, but the full set — jitter columns, sequence and port columns, ICMP type and code, NAT detection, forward/backward loss heuristics, DSCP/ECN, and ASN — is one c press away.

Why Does Trippy Need Elevated Privileges?

Trippy's normal mode sends raw ICMP, UDP, and TCP packets, and operating systems only let privileged processes craft raw packets — so you either run it elevated, grant it the raw-socket capability once, or use its unprivileged mode. This is not a Trippy quirk; every traceroute-class tool on every OS faces the same rule. Here are the three routes, pick one.

The simplest route is sudo trip example.com, which is what the project's own README uses in its run example. If you would rather not type sudo every time, the Linux one-time route is the official guide's exact form: sudo setcap CAP_NET_RAW+p $(which trip) — this grants the binary the raw-socket capability permanently, and the equivalent cap_net_raw+ep form works the same way. On Windows, run your terminal as Administrator.

The third route is what the trippy unprivileged flag is for: --unprivileged (short -u) traces without elevated privileges on supported platforms for ICMP, UDP, and TCP alike — handy on locked-down machines where you cannot sudo at all. You can also make it permanent in the config file with [trippy] unprivileged = true. Whichever route you take, the TUI's information bar displays privileged or unprivileged so you always know which mode you are actually in.

What Are Trippy's ECMP Modes (Paris and Dublin)?

On load-balanced networks, classic traceroute-style probes can bounce between different paths on every run, producing traces that contradict themselves — Trippy's ECMP modes pin each probe flow to one consistent path so the results stay trustworthy. ECMP (Equal-Cost Multi-Path) routing is everywhere on the modern internet: big networks split traffic across parallel links, and routers decide which link each packet takes by hashing fields in the packet header. If your probe packets hash differently from one round to the next, hop 7 in round one and hop 7 in round two are literally different routers, and the output looks haunted.

If you searched for "trippy ecmp", the flag you are looking for is -R / --multipath-strategy — note it applies to UDP mode only. The three strategies are:

In practice: sudo trip -R paris example.com when your traces wobble on paths you know are load-balanced, and compare against classic to see the difference the pinning makes. This is one of the ideas Trippy takes from libparistraceroute and Dublin Traceroute, per the project's own acknowledgements — and it is the single biggest reason Trippy's output stays readable on real backbone networks where classic traceroute falls apart.

Can Trippy Trace Multiple Targets and Show DNS and GeoIP?

Yes — hand the trip command several targets and it opens one tab per target in the same window; add a DNS resolver flag, an AS-info flag, and a GeoIP database, and each hop gains names, network ownership, and a dot on the world map. Multi-target tracing is the feature that turns Trippy from a one-off diagnostic into a monitoring dashboard: sudo trip example.com google.com crates.io traces all three in parallel, and you switch tabs with 1, 2, and 3.

DNS resolution is controlled by -r / --dns-resolve-method: system (the default, your OS resolver), resolv (reads /etc/resolv.conf directly), google (8.8.8.8), or cloudflare (1.1.1.1). Add -z / --dns-lookup-as-info and Trippy looks up each hop's Autonomous System number via Team Cymru's IP-to-ASN mapping service, so instead of a bare IP you see which network actually owns the router. If reverse DNS feels like magic, our DNS lookup guide explains what is happening under the hood.

If you searched for "trippy geoip", these are the two flags you want: -G / --geoip-mmdb-file points Trippy at a MaxMind or IPinfo .mmdb database, and pressing g toggles the interactive world map. The --tui-geoip-mode flag controls how much detail each hop shows: off, short (the default), long, or location (latitude/longitude only).

Two protocol notes while you are here. The -p / --protocol flag selects icmp (the default), udp, or tcp — with --icmp, --udp, and --tcp as shorthands — and -P / --target-port (default 80) plus -S / --source-port (automatic by default) apply to TCP and UDP. Switch to TCP when a path filters ICMP aggressively: probes that look like ordinary web traffic get far more honest answers. The -F / --addr-family flag forces ipv4 or ipv6 when you need to test one family deliberately.

Trippy vs Traceroute vs MTR: Which Should You Use?

Use Trippy whenever you would otherwise run traceroute more than once — as a traceroute alternative it wins the moment the first static snapshot leaves you with questions, and against mtr it wins on visualization while keeping the same continuous-probing soul. The three tools are one family, not rivals, and the table below is the honest map.

The trippy vs traceroute question answers itself: traceroute is a photograph, Trippy is a live feed, and intermittent problems only show up on the live feed. The trippy vs mtr question is closer — Trippy draws heavily from mtr, so if you already live in mtr you will feel at home immediately — but the RTT history chart alone justifies the switch: seeing a latency spike as a shape on a graph, at a specific minute, next to the hop that caused it, is worth more than a screenful of numbers. Keep classic traceroute installed for the one-shot checks; graduate to Trippy for everything else.

How Do You Read Trippy's Output Without Panicking?

Read the target row, not the middle rows: loss or silence at an intermediate hop usually means that router ignored your probe, not that your traffic is dying. Trippy's own column reference encodes this directly in its hop-status semantics — a non-target hop showing packet loss does not necessarily indicate a problem, and an unresponsive non-target hop does not necessarily indicate a problem either. Only sustained loss at the target hop likely indicates a real problem. Internalize that and ninety percent of trace-reading anxiety disappears.

Asterisks and blank hops have a similarly boring explanation most of the time. An asterisk means the probe got no reply before the timeout, and the common causes are ICMP filtering, rate limits, or a router that simply does not prioritize answering traceroute traffic. If the trace continues past the stars and the final hop is healthy, the path is almost certainly fine for real application traffic — the router answered your data just fine; it just could not be bothered to answer your question about itself.

The famous trap is the single slow hop: hop 6 shows 180 ms while hops 7 through 12 all show 25 ms. That is not congestion — it is the router at hop 6 deprioritizing your probe packets. Generating ICMP "time exceeded" replies is low-priority work for a busy router, far below forwarding actual user traffic, and some routers ignore probe traffic on purpose on heavily loaded backbones. The rule: a latency spike that shrinks back down at later hops is the router answering slowly; a jump that persists at every later hop is a delay that genuinely starts there. The Sts status column summarizes each hop's health, and the jitter columns (Jttr, Javg, Jmax, Jint) plus the forward/backward loss heuristics (Floss, Bloss) help you separate "this router is slow to answer" from "this link is actually losing packets".

What Are the 7 Mistakes Every Trippy Beginner Makes?

Every beginner hits the same wall in the same order. Here is the wall, in advance, so you can walk around it.

How Do You Script Trippy and Save Its Settings?

Drop the TUI with -m and Trippy becomes a scriptable reporter; save your preferences in trippy.toml and it loads them automatically on every run. The -m / --mode flag replaces the interactive interface with stream, pretty, markdown, csv, json, dot, flows, or silent output, and -C / --report-cycles (default 10) controls how many rounds each report covers. A JSON report piped into your monitoring is how Trippy graduates from a debugging session into infrastructure.

For settings you always want, Trippy auto-discovers a trippy.toml (or .trippy.toml) in your current directory, your home directory, your XDG config directory, or %APPDATA% on Windows — no flag needed. Run trip --print-config-template once to print a fully commented starter file, save the pieces you want, and use -c / --config-file to point at a specific file when you keep several. This is also where the permanent [trippy] unprivileged = true setting lives if you chose the unprivileged route.

One last caveat before you go trace the world: if your machine routes through a VPN, the hops you see are the tunnel's hops, not the internet's — the encrypted tunnel hides the real path by design. Our VPN beginner guide explains why, and the practical fix is simple: run the trace from outside the tunnel, or from the server itself, when you want the true path.

Sources

Every version number, flag name, and default value in this guide was verified against the following sources, all fetched for this article: the official Trippy installation guide (trippy.rs/start/installation/), the Trippy CLI reference (trippy.rs/reference/cli/), the Trippy column reference (trippy.rs/reference/column/), the Trippy privileges guide (trippy.rs/guides/privileges/), the Trippy GitHub repository README, releases, and changelog (github.com/fujiapple852/trippy), the X-CMD Trippy setup page (x-cmd.com/install/trippy/), DigitalOcean's "How to Use Traceroute and MTR to Diagnose Network Issues", and Contabo's "How to Use the Traceroute Command and Interpret Its Output".

Frequently Asked Questions

Why is the command called trip and not trippy?

The package and project are called Trippy, but the installed binary is trip — the CLI usage line reads Usage: trip [OPTIONS] [TARGETS]..., and the project's own run example is sudo trip example.com. Install the trippy package with your package manager, then forget the name trippy exists at the command line and type trip forever.

Do I need sudo to run Trippy?

In normal mode, yes, because it sends raw packets — but you have three options: run it with sudo, grant the capability once with sudo setcap CAP_NET_RAW+p $(which trip) on Linux, or use the --unprivileged flag, which works without elevated privileges on supported platforms. On Windows, run your terminal as Administrator. The TUI's information bar always shows whether you are privileged or unprivileged.

Why does a middle hop show 100% loss while the target is fine?

Because that router is ignoring your probes, not dropping your traffic. Trippy's own status semantics say it plainly: packet loss at a non-target hop does not necessarily indicate a problem — only sustained loss at the target hop likely does. Routers deprioritize the work of answering traceroute probes far below the work of forwarding real packets, so a red-looking middle row with a green target row is a healthy trace, not a broken one.

What is the difference between the paris and dublin multipath modes?

Both pin your probes to one consistent path through load-balanced (ECMP) networks; they differ only in which packet field carries the sequence number. Paris mode stores it in the UDP checksum field, dublin mode stores it in the IP identifier field (with IPv6 support since 0.10.0), while the default classic mode uses the source or destination port. Both are UDP-only, selected with -R / --multipath-strategy, and both come from the Paris traceroute and Dublin Traceroute techniques the project credits.

Can I use Trippy in scripts without the terminal UI?

Yes — the -m / --mode flag swaps the TUI for stream, pretty, markdown, csv, json, dot, flows, or silent output, with -C / --report-cycles controlling how many rounds each report covers. A json report is the usual choice for feeding results into monitoring or alerting pipelines.