Do you wonder about how traceroute works? Here is how the traditional traceroute works…
Time To Live (TTL) is a part of the IP header, it is designed to prevent packets from looping forever.
When you send a packet, each router (hop) on the way will decrement the TTL value by one.
When the TTL value reaches zero (0), the packet is said to be ‘expired’ and is discarded.
The router that discards this packet will send an ICMP ‘Time Exceeded’ back to the sender.
By launching a ‘traceroute’ in linux you will send a series of UDP packets towards your target with an TTL starting at 1, and increased with 1 until the target is reached.
Fully explained, let us say you have this path to 10.0.1.2
By sending a packet with TTL one, then 10.0.5.1 will send you an ICMP Time Exceeded – and you have the first line in the traceroute.
TTL is set to 2 on the next packet, 172.16.1.1 will reply with ICMP Time Exceeded and you can see hop number two.
This method of tracerouting depends on the practise of sending ICMP packets back when the TTL has expired and the packet is discarded, when the packet it only discarded you will often see just a * * * in the traceroute, this also happens if the path is down. That’s usually when you do not reach your target.