watch mode·
-W NLearn the path, then watch for changes.
lft -W 5 target:443 turns a trace into a live instrument: per-hop loss, min/avg/max RTT, jitter, a sparkline of RTT history, and — with no -A needed — the ASN, network and organization from Prefix WhoIs. And a path-change detector that alerts only on genuine reroutes.
watch mode, as it runs
Four screens saved from one live session of lft -W 5 eggs.gnu.org:587, run from a cloud host in New York. Nothing is mocked or retouched; runs of empty rows are trimmed (⋮). Each capture is followed by notes on what the screen is showing.
┌──┤ Layer Four Traceroute (LFT) ├───────────┤ End-to-End RTT 7–17ms, 9 hops to tcp://eggs.gnu.org:587 ├────────────────────────────┤ Candlestick ├──┐ │ │ │ ┌─── SOURCE ────┐ ┌── HOP 1 ──┐ ┌─── HOP 2 ───┐ ┌ HOP 3 ┐ ┌── HOP 4 ───┐ ┌── HOP 5 ───┐ ┌── HOP 6 ───┐ ┌── HOP 7 ───┐ │ │ 1ms max 2ms max ░░░░░░░ 1ms max 7ms max 8ms max 7ms max │ │17ms ┤ ░░░░░░░ │ │ │ ░░░░░░░ │ │12ms ┤ ░░░░░░░ │ │ │ ░░░░░░░ │ │ 8ms ┤ ░░░░░░░ ─────┬────── ████████████ ████████████ │ │ │ ░░░░░░░ │ ─────┴────── ─────┴────── │ │ 3ms ┤ ─────┬───── ──────┬────── ░░░░░░░ ─────┬────── ████████████ │ │ │ ███████████ █████████████ ░░░░░░░ ████████████ │ │ 0ms min 0ms min ░░░░░░░ 1ms min 2ms min 6ms min 7ms min │ │ └─── SOURCE ────┘ └── HOP 1 ──┘ └─── HOP 2 ───┘ └ HOP 3 ┘ └── HOP 4 ───┘ └── HOP 5 ───┘ └── HOP 6 ───┘ └── HOP 7 ───┘ │ │ 104.248.55.1:522… -> 198.211.111.7 -> 143.244.192.144 -> cloaked -> 143.244.225.21 -> 198.32.160.208 -> 198.160.63.126 -> 198.160.62.201 │ │ 0/0/1ms 0/0/2ms TTL 3 1/1/1ms 2/2/7ms 6/7/8ms 7/7/7ms │ │ │ │ ┌── HOP 8 ──┐ ┌── HOP 9 ──┐ ┌ HOP 10-11 ┐ │ │ 7ms max 17ms max ░░░░░░░░░░░ │ │17ms ┤ ─────┬───── ░░░░░░░░░░░ │ │ │ │ ░░░░░░░░░░░ │ │12ms ┤ │ ░░░░░░░░░░░ │ │ │ ███████████ ░░░░░░░░░░░ │ │ 8ms ┤ ███████████ ─────┴───── ░░░░░░░░░░░ │ │ │ ─────┴───── ░░░░░░░░░░░ │ │ 3ms ┤ ░░░░░░░░░░░ │ ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ HOP HOST LOSS% MIN AVG MAX JIT ASN NETNAME ORGNAME │ │ 1m ──────── current │ │ 1 198.211.111.7 0% 0.3 0 1.4 1 AS14061 DIGITALOCEAN-198 DigitalOcean, LLC ▂▂▂▂▃▂▂▂▃▂▂▂▂▂▃▄▂▃▂▂│ │ 2 143.244.192.144 0% 0.3 0 2.3 2 - - - ▂▂▂▂▂▂▂▂▂▂▁▂▂▁▂▂▂▂▂▂│ │ 3 * 100% 0.0 0 0.0 0 - - - ▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪│ │ 4 ae5.iar2.us-ewr1.as14061.net 5% 0.6 1 1.4 1 - - - ▆▅▅▃▅▄▄▄▄▄▄▄▅▃▄▄▄▄▄▄│ │ 5 nyiix-px.jfk01.twdx.net 0% 1.6 2 6.6 5 - - - ▃▃▃▃▃▃▃▂▂▃▃▄▂▂▃▃▂▃▃▃│ │ 6 bbr02-ae-4-901.bos01.twdx.net 23% 6.3 7 8.1 2 AS27552 TWDX-NETBLK-ARIN TowardEX Technologie ▪▆▪▇▪▇▪▆▆▆▪▆▪▇▆▇▆▆▆▆│ │ 7 dcr03-hu-0-8-0-0.bsn04.twdx.net 65% 6.6 7 7.5 1 AS27552 TWDX-NETBLK-ARIN TowardEX Technologie ▪▇▪▇▪▇▪▇▪▪▪▇▪▪▪▪▪▪▇▪│ │ 8 mass-ix.fsf.org 81% 6.3 7 7.5 1 - - - ▪▪▪▪▪▪▪▪▪▪▪█▪▪▪▪▪▪▪▪│ │ 9 eggs.gnu.org 88% 6.5 9 17.2 11 AS22989 HURRICANE-5 Hurricane Electric L ▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪│ │ *** PATH CHANGE DETECTED at 19:09:53 *** │ │ │ │ ⋮ │ └──┤ ⠦ ↓241 ↑479 ⬡ 9 ✔ ├────────────────────┤ Idle ~5s Cycle 43/∞ tcp://eggs.gnu.org:587 ├──────────────────────────────────────────────────┘
- Top band. One candlestick per hop: whiskers span min to max RTT, the bar sits at the average. The millisecond scale on the left is shared across hops so a slow hop stands out at a glance.
- Shaded columns. Hop 3 is a router that never answers; LFT keeps its place in the path and marks it cloaked rather than pretending the path is one hop shorter. The HOP 10–11 column appeared when the path briefly lengthened during the session and was kept so the history stays readable.
- Path line and stats. Under the chart, the hops in order and each one’s min/avg/max. The source hop shows the rotating source port.
- Lower table. Loss, min/avg/max, jitter and the ASN, network and organization from Prefix WhoIs, with no
-Agiven. The rightmost column is a one-minute sparkline;▪is a lost probe. The rising loss at hops 8 and 9 is the exchange point and the target answering fewer of our probes as the session wears on: rate limiting of a persistent prober, which is itself worth knowing about a path. - The banner. The source network load-balances across several first-hop routers. The first time a new address appears at a hop the detector calls it a change; once an address has been seen, alternating back to it is logged quietly as an ECMP shift.
- Bottom bar. Activity spinner, probes received and sent, hop count, health mark, cycle number, interval and target.
2.┌──┤ Layer Four Traceroute (LFT) ├───────────┤ End-to-End RTT 7–17ms, 9 hops to tcp://eggs.gnu.org:587 ├───────────────────────────────────┤ Bars ├──┐ │ 20ms │ │ │ │ ▄ │ │ │ │ ⋮ │ │ 9ms ██████████████ │ │ ▄ ██████████████ │ │ ██████████████ ██████████████ ██████████████ ██████████████ │ │ ██████████████ ██████████████ ██████████████ ██████████████ │ │ ██████████████ ██████████████ ██████████████ ██████████████ │ │ ██████████████ ██████████████ ██████████████ ██████████████ │ │ ▄ ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ │ │ ▄ ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ │ │ 0ms ██████████████ ██████████████ * ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ ██████████████ │ │ 1 2 3 4 5 6 7 8 9 │ │ 198.211.111.7 143.244.192.15 * 143.244.225.21 198.32.160.208 198.160.63.128 198.160.62.201 206.53.143.61 209.51.188.92 │ ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ HOP HOST LOSS% MIN AVG MAX JIT ASN NETNAME ORGNAME │ │ 1m ──────── current │ │ 1 198.211.111.7 0% 0.3 0 1.4 1 AS14061 DIGITALOCEAN-198 DigitalOcean, LLC █▂▂▂▂▂▂▂▂▂▂▂│ │ 2 143.244.192.154 0% 0.3 1 2.3 2 - - - ▃▂▂▂▂█▂▂▂▂▁▁│ │ 3 * 100% 0.0 0 0.0 0 - - - ▪▪▪▪▪▪▪▪▪▪▪▪│ │ 4 143.244.225.21 8% 0.7 1 1.4 1 - - - █▅▅▅▅▪▆▅▄▅▄▅│ │ 5 198.32.160.208 0% 1.6 2 2.6 1 - - - ▆▆▆▆▅▇▆█▅▆▅▆│ │ 6 198.160.63.128 17% 6.4 7 8.1 2 AS27552 TWDX-NETBLK-ARIN TowardEX Technologie █▆▇▆▆▆▆▪▪▆▇▆│ │ 7 198.160.62.201 42% 6.7 7 7.5 1 AS27552 TWDX-NETBLK-ARIN TowardEX Technologie ▇▇▇▇▇█▇▪▪▪▪▪│ │ 8 206.53.143.61 50% 6.3 7 7.5 1 - - - ▇▆█▇▪▇▇▪▪▪▪▪│ │ 9 209.51.188.92 58% 6.5 9 17.2 11 AS22989 HURRICANE-5 Hurricane Electric L █▄▃▄▪▪▃▪▪▪▪▪│ │ *** PATH CHANGE DETECTED at 19:06:59 *** │ │ │ │ ⋮ │ └──┤ ⠴ ↓85 ↑138 ⬡ 9 ✔ ├────────────────────┤ Idle ~5s Cycle 12/∞ tcp://eggs.gnu.org:587 ├──────────────────────────────────────────────────┘
- Bars are drawn to the average RTT against the millisecond scale on the left; the small
▄marker above each bar is the worst sample seen.*stands in for the cloaked hop. - Hop addresses run along the bottom of the chart. Hops 6 and 7 are the same Boston network at 7 ms; the jump between hops 5 and 6 is the New York to Boston leg.
- The same table follows underneath, so the numbers are never more than a glance away from the picture.
3, then h.┌──┤ Layer Four Traceroute (LFT) ├─────────────────────────────────────────────────────────────────────────────────────────────────┤ Status Board ├──┐ │HOP HOST LOSS% SENT RECV MIN AVG MAX STDDEV LAST ASN NETNAME ORGNAME │ │ 1 198.211.111.7 0% 14 14 0.3 0.4 1.4 0.3 0.3 AS14061 DIGITALOCEAN-19 DigitalOcean, LLC │ │ 2 143.244.192.148 0% 14 14 0.3 0.6 2.3 0.5 0.5 - - - │ │ 3 * 100% 14 0 0.0 0.0 0.0 0.0 0.0 - - - │ │ 4 ae6.iar2.us-mnh1.as1 7% 14 13 0.7 0.9 1.4 0.3 0.8 - - - │ │ 5 nyiix-px.jfk01.twdx. 0% 14 14 1.6 2.1 2.6 0.3 1.8 - - - │ │ 6 bbr01-be-10801.bsn05 21% 14 11 6.4 6.8 8.1 3.2 6.6 AS27552 TWDX-NETBLK-ARI TowardEX Technologi │ │ 7 dcr03-hu-0-8-0-0.bsn 50% 14 7 6.7 7.1 7.5 5.0 6.9 AS27552 TWDX-NETBLK-ARI TowardEX Technologi │ │ 8 mass-ix.fsf.org 57% 14 6 6.3 6.9 7.5 5.2 7.0 - - - │ │ 9 eggs.gnu.org 64% 14 5 6.5 9.4 17.2 7.9 6.5 AS22989 HURRICANE-5 Hurricane Electric │ │ │ │ ⋮ │ └──┤ ⠹ ↓94 ↑160 ⬡ 9 ✔ ├────────────────────┤ Idle ~5s Cycle 14/∞ tcp://eggs.gnu.org:587 ├──────────────────────────────────────────────────┘
- For long paths. The chart gives way to as many rows as the terminal has, with SENT and RECV counts, standard deviation and the last sample added.
- Hostnames replace addresses on
h. Reverse lookups run in the background and fill in as they arrive; here the exchange point, the Boston core routers and the target are all named. Names are clipped to the column, which is why view 1 is the better home for long hostnames.
v in any view; here over view 1.┌──┤ Layer Four Traceroute (LFT) ├───────────┤ End-to-End RTT 7–17ms, 9 hops to tcp://eggs.gnu.org:587 ├────────────────────────────┤ Candlestick ├──┐ │ │ │ ┌─── SOURCE ────┐ ┌── HOP 1 ──┐ ┌─── HOP 2 ───┐ ┌ HOP 3 ┐ ┌── HOP 4 ───┐ ┌── HOP 5 ───┐ ┌── HOP 6 ───┐ ┌── HOP 7 ───┐ │ │ 1ms max 2ms max ░░░░░░░ 1ms max 7ms max 8ms max 7ms max │ │17ms ┤ ░░░░░░░ │ │ │ ░░░░░░░ │ │12ms ┤ ░░░░░░░ │ │ │ ░░░░░░░ │ │ 8ms ┤ ░░░░░░░ ─────┬────── ████████████ ████████████ │ │ │ ░░░░░░░ │ ─────┴────── ─────┴────── │ │ 3ms ┤ ─────┬───── ──────┬────── ░░░░░░░ ─────┬────── ████████████ │ │ │ ███████████ █████████████ ░░░░░░░ ████████████ │ │ 0ms min 0ms min ░░░░░░░ 1ms min 2ms min 6ms min 7ms min │ │ └─── SOURCE ────┘ └── HOP 1 ──┘ └─── HOP 2 ───┘ └ HOP 3 ┘ └── HOP 4 ───┘ └── HOP 5 ───┘ └── HOP 6 ───┘ └── HOP 7 ───┘ │ │ 104.248.55.1:529… -> 198.211.111.7 -> 143.244.192.146 -> cloaked -> 143.244.225.25 -> 198.32.160.208 -> 198.160.63.128 -> 198.160.62.201 │ │ 0/0/1ms 0/0/2ms TTL 3 1/1/1ms 2/2/7ms 6/7/8ms 7/7/7ms │ │ │ │ ┌── HOP 8 ──┐ ┌── HOP 9 ──┐ ┌ HOP 10-11 ┐ │ │ 7ms max 17ms max ░░░░░░░░░░░ │ │17ms ┤ ─────┬───── ░░░░░░░░░░░ │ │ │ │ ░░░░░░░░░░░ │ │12ms ┤ │ ░░░░░░░░░░░ │ │ │ ███████████ ░░░░░░░░░░░ │ │ 8ms ┤ ███████████ ─────┴───── ░░░░░░░░░░░ │ │ │ ─────┴───── ░░░░░░░░░░░ │ │ 3ms ┤ ░░░░░░░░░░░ │ ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ HOP HOST LOSS% MIN AVG MAX JIT ASN NETNAME ORGNAME │ │ 1m ──────── current │ │ 1 198.211.111.7 0% 0.3 0 1.4 1 AS14061 DIGITALOCEAN-198 DigitalOcean, LLC ▂▂▂▃▂▂▂▃▂▂▂▂▂▃▄▂▃▂▂▂│ │ 2 143.244.192.146 0% 0.3 0 2.3 2 - - - ▂▂▂▂▂▂▂▂▂▁▂▂▁▂▂▂▂▂▂▂│ │ 3 * 100% 0.0 0 0.0 0 - - - ▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪▪│ │ 4 ae6.iar2.us-ewr1.as14061.net 5% 0.6 1 1.4 1 - - - ▅▅▃▅▄▄▄▄▄▄▄▅▃▄▄▄▄▄▄▅│ ├─── Trace Log Live · ↑k ↓j to scroll · [v] close────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ TTL LFT trace to eggs.gnu.org (209.51.188.92):587/tcp │ │ 1 198.211.111.7 0/0/0 ±0ms │ │ 2 143.244.192.146 0/0/0 ±0ms │ │ ** [neglected] no reply packets received from TTL 3 │ │ 4 ae6.iar2.us-ewr1.as14061.net (143.244.225.25) 1/1/1 ±0ms │ │ 5 nyiix-px.jfk01.twdx.net (198.32.160.208) 2/2/2 ±0ms │ │ 6 bbr01-be-10801.bsn05.twdx.net (198.160.63.128) 7/7/7 ±0ms │ │ ** [587/tcp sequence anomaly from target] Try advanced options (use -VV to see packets). │ │ cycle 44: 9 hops, target_open │ │ PATH CHANGE at hop 2: was 143.244.192.144, now 143.244.192.146 │ └──┤ ⠹ ↓246 ↑490 ⬡ 9 ✔ ├────────────────────┤ Idle ~5s Cycle 44/∞ tcp://eggs.gnu.org:587 ├──────────────────────────────────────────────────┘
- The drawer slides over the lower half and holds the running trace log: per-hop results as each cycle completes, LFT’s own notices such as neglected hops and sequence anomalies, and a one-line summary per cycle.
- Path events land here too. The last line records the change the banner announced, with the old and new address, so the history survives after the banner clears. Scroll with
jandk;xsaves the whole screen as text and colour ANSI.
the detector, replayed
A modelled session on the same path, sped up so the detector’s whole life fits in a minute: it learns, arms, logs a flap and an ECMP shift quietly, then flashes a confirmed change.
Layer Four Traceroute (LFT) · End-to-End RTT 7ms, 9 hops to tcp://eggs.gnu.org:587View 3 · Table
LEARNING — path length not yet stable; no alerts
| HOP | HOST | LOSS% | MIN | AVG | MAX | JIT | ASN | NETNAME | ORGNAME | (newest →) |
|---|
[1-3]view [q]quit [p]pause [r]reset [c]clear [v]log [w]whois [h]host [s]seams [x]save [+/-]interval
Legend: sparkline green within 20% of the hop average · yellow 20–50% above · magenta over 50% · red lost probe. Source hop uses a documentation-range address. Only the confirmed change flashes the status bar; everything else goes to the log drawer.
Three views, one keyboard
Views on the 1/2/3 keys: an RTT candlestick chart over a rolling statistics table, proportional RTT bars, or a full-height table for long paths. Press h for hostnames, w to hide the whois columns, s to show AS and network seams, v for the log drawer, x to save the screen as .txt and .ansi, +/- to change the interval, p to pause, c to clear and re-learn, q to quit.
Learn first. Alert later.
Path-change detection alerts only on genuine reroutes. It learns first — until the path length holds for three cycles, or eight cycles at most — then requires a changed hop to persist for two observed cycles before it flashes the status bar. A one-cycle change is logged as a flap. A hop alternating among addresses already seen at that TTL is logged as an ECMP shift, not a path change. Path-length changes are noted quietly. Cloaked cycles (*) neither advance nor cancel a pending change, so reroutes behind rate-limited hops still confirm.
Hold the flow. Rotate the port.
Watch cycles stay on one ECMP branch: the TCP source port, UDP IP-ID base and ICMP sequence anchor are held constant within a session, and the source port rotates between cycles so each cycle presents a fresh flow to stateful middleboxes.
After the path stabilizes, topology inheritance narrows the TTL range, widens the in-flight pipeline and tightens timeouts. --no-learn disables it; --learn-margin N sets the TTL margin above the learned length (default 2).
lft -W 5 www.example.com:443
lft --watch 10 --show-seams -A www.example.com:443
lft -W 5 --no-learn www.example.com:443
Requires ncurses at build time and a terminal of at least 24 rows.