{"slug":"troubleshoot-derp-traffic-routing-issues","title":"Troubleshoot DERP traffic routing issues","tags":["tailscale","networking"],"agent_summary":"Last validated: Mar 16, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Troubleshoot DERP traffic routing issues\r\n\r\nLast validated: Mar 16, 2026\r\n\r\nTo get in-depth information to troubleshoot [direct and relayed connections](https://tailscale.com/docs/reference/connection-types), use the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli) to run the [`tailscale status`](https://tailscale.com/docs/reference/tailscale-cli#status) command. If you observe output in the form of `relay \"code\"`, then your traffic is being routed through a [DERP server](https://tailscale.com/docs/reference/derp-servers) that has \"code\" as its location. For example, the second line in this `tailscale status` output indicates traffic is being routed through the \"sea\" (Seattle) relay server:\r\n\r\n```shell\r\n100.99.98.97 device1 linux active; direct 1.2.3.4:1234; tx 1000 rx 1000\r\n100.99.98.96 device2 linux active; relay \"sea\", tx 1000 rx 1000\r\n```\r\n\r\nIf there is no `relay \"code\"` line in the `tailscale status` output, then your traffic is not being routed through DERP.\r\n\r\nAlso, the [`tailscale ping`](https://tailscale.com/docs/reference/tailscale-cli#ping) command will indicate whether a successful ping was by direct path or using DERP. `tailscale ping` will keep trying until it either sends 10 pings (the default if not using the `--c` flag) through the relays, or finds a direct path. For example, if the first five pings were relayed and the sixth ping was a direct path, `tailscale ping` will stop. This `tailscale ping device2` example indicates the device was reached using the \"sea\" relay on the first ping, and by direct path on the second ping, at which time `tailscale ping` stopped.\r\n\r\n```shell\r\ntailscale ping device2\r\n\r\npong from device2 (100.99.98.96) via DERP(sea) in 242ms\r\npong from device2 (100.99.98.96) via 1.2.3.4:1234 in 127ms\r\n```\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Troubleshoot DERP traffic routing issues

\n

Last validated: Mar 16, 2026

\n

To get in-depth information to troubleshoot direct and relayed connections, use the Tailscale CLI to run the tailscale status command. If you observe output in the form of relay \"code\", then your traffic is being routed through a DERP server that has \"code\" as its location. For example, the second line in this tailscale status output indicates traffic is being routed through the \"sea\" (Seattle) relay server:

\n
100.99.98.97 device1 linux active; direct 1.2.3.4:1234; tx 1000 rx 1000\r\n100.99.98.96 device2 linux active; relay \"sea\", tx 1000 rx 1000\n
\n

If there is no relay \"code\" line in the tailscale status output, then your traffic is not being routed through DERP.

\n

Also, the tailscale ping command will indicate whether a successful ping was by direct path or using DERP. tailscale ping will keep trying until it either sends 10 pings (the default if not using the --c flag) through the relays, or finds a direct path. For example, if the first five pings were relayed and the sixth ping was a direct path, tailscale ping will stop. This tailscale ping device2 example indicates the device was reached using the \"sea\" relay on the first ping, and by direct path on the second ping, at which time tailscale ping stopped.

\n
tailscale ping device2\r\n\r\npong from device2 (100.99.98.96) via DERP(sea) in 242ms\r\npong from device2 (100.99.98.96) via 1.2.3.4:1234 in 127ms\n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}