How does traceroute discover the path to a server?
It sends packets with TTL set to 1, then 2, then 3 and so on. Each router that drops a packet at TTL 0 replies with an ICMP Time Exceeded message, revealing its address, until the destination itself replies.
Explain it simply
Imagine sending letters that each say "return me after N stops". The first letter returns after one stop, the second after two. From the return stamps, you list every stop along the road.
Example
TTL=1 -> router 1 drops it, replies ICMP Time Exceeded (shows hop 1)
TTL=2 -> router 2 drops it, replies ICMP Time Exceeded (hop 2)
TTL=3 -> router 3 ...
TTL=n -> destination replies (ICMP Echo Reply or Port Unreachable)
traceroute example.com # Linux/macOS (UDP probes by default)
tracert example.com # Windows (ICMP echo probes)Each hop usually gets three probes, so you see three round-trip times per line. A line of * * * means no reply, often because a router is configured not to send ICMP, not necessarily a failure.
A jump in latency at a hop that continues for all later hops shows where the delay starts. A high time at a single hop followed by low times does not matter, since routers may deprioritise replying to probes while forwarding normally.
What to say in the interview
"Traceroute raises TTL one at a time and reads the ICMP Time Exceeded replies to list each router. Stars do not always mean a problem. Linux uses UDP probes and Windows uses ICMP echo."
Common mistakes
- Treating one slow hop in the middle as the cause of slowness when later hops are fast.