A method comprising: encapsulating an inner packet configured with a multicast address and configured to perform a traceroute operation through a network to form an encapsulated packet; sending the encapsulated packet into the network, the encapsulated packet being forwarded along a multicast tree of the network for the multicast address; and receiving responses from a plurality of network nodes comprising the multicast tree, wherein each response comprises an indication of a node of the plurality of network nodes that sends the response and an indication of a node from which the node sending the response received the encapsulated packet, and an internet protocol, IP, address for the node of the plurality of network nodes that sends the response; characterised in that each response further comprises: a time to live, TTL, value for the encapsulated packet, an ingress port over which the encapsulated packet was received, an egress port over which the encapsulated packet was sent to the node of the plurality of network nodes that sends the response, an application specific integrated circuit, ASIC, number for the node of the plurality of network nodes that sends the response, or an ASIC port number for the node of the plurality of network nodes that sends the response, a timestamp of receipt of the encapsulated packet, and a neighboring switch node or interface for an incoming interface. encapsulating an inner packet configured with a multicast address and configured to perform a traceroute operation through a network to form an encapsulated packet; sending the encapsulated packet into the network, the encapsulated packet being forwarded along a multicast tree of the network for the multicast address; and receiving responses from a plurality of network nodes comprising the multicast tree, wherein each response comprises an indication of a node of the plurality of network nodes that sends the response and an indication of a node from which the node sending the response received the encapsulated packet, and an internet protocol, IP, address for the node of the plurality of network nodes that sends the response; characterised in that each response further comprises: a time to live, TTL, value for the encapsulated packet, an ingress port over which the encapsulated packet was received, an egress port over which the encapsulated packet was sent to the node of the plurality of network nodes that sends the response, an application specific integrated circuit, ASIC, number for the node of the plurality of network nodes that sends the response, or an ASIC port number for the node of the plurality of network nodes that sends the response, a timestamp of receipt of the encapsulated packet, and a neighboring switch node or interface for an incoming interface. a time to live, TTL, value for the encapsulated packet, an ingress port over which the encapsulated packet was received, an egress port over which the encapsulated packet was sent to the node of the plurality of network nodes that sends the response, an application specific integrated circuit, ASIC, number for the node of the plurality of network nodes that sends the response, or an ASIC port number for the node of the plurality of network nodes that sends the response, a timestamp of receipt of the encapsulated packet, and a neighboring switch node or interface for an incoming interface.