Architecture

How a traceroute request travels from the visitor's browser to a probe and back, and which part of the platform each probe network goes through. Everything in the dashed frame runs on GeoTraceroute's own servers.

Visitor page traffic Traceroute measurement Internal call Globalping API
GEOTRACEROUTE SERVERS TLS TLS SSH SSH TLS TLS h2 + TLS Visitor browser 3D globe, 2D map proof-of-work, GP request Cloudflare TLS, proxy JS / CSS cache Web server geolocation engine trace cache, live hops Path inference engine cable + rail paths (A*) router name rules Probe orchestration hub schedules traces, streams hops back Local probe local mtr MariaDB probes, routers, shares FW + nginx FW + nginx Globalping public API, free tier 3,000+ probes worldwide api.globalping.io SSH probes mtr and ping only, no shell multiplexed SSH sessions NLNOG RING 300+ nodes reached over SSH operator community network Docker probes contributor-hosted agent dials out, so no open port 1 2 3 4 5 6 7 8 9
1

Page and request. The browser loads the site through Cloudflare, then the server's firewall and nginx, solves a short proof-of-work and sends the target. Hops come back live on the same connection.

2

Globalping measurement. For a Globalping probe, the browser itself creates the measurement on the free API, using the visitor's own quota, and only sends its id to the server.

3

Read back and check. The server fetches the result by id and checks it before use: traceroute type, same target and probe, recent, id never used before.

4

Path inference. The web server asks the path inference engine for router name rules, then for the physical path between hops over submarine cables and rail-side fiber.

5

Local probe. The default probe runs mtr on the server itself.

6

SSH probes. Hosted probes reached over SSH with an account limited to mtr and ping. Resolution and trace share one multiplexed session.

7

NLNOG RING. Nodes of the operator community network, traced over SSH the same way.

8

Hub request. For a Docker probe, the web server asks the probe orchestration hub on the internal network, which streams the hops back line by line.

9

Docker probes. Each agent keeps an outbound HTTP/2 connection, through the firewall and nginx, to the probe orchestration hub and receives its traces there, so contributors open no port.

Back to site