How does traceroute work?
It uses the TTL (Time To Live) parameter and UDP to get the path. Each router which is passed needs to decrease the TTL value of a packet and if it is below 1 the router will discard it and send a ICMP (time exceeded) back to the source. So traceroute sends the first packet with a TTL of 1 to reach the first router and one more with a TTL of 2 to reach the second and so on. You get the picture. But how does it know when the destination is reached? Well it useses another trick for that. Traceroute sends out a UDP Packet with it with a port higher than 3000. It is very unlikely that this port will be opened at the destination so it will get back from the destination a ICMP packet (port unreachable) which is the answer to the question.
Important: Remember that not all packets are going the same way and it’s likely that they use different paths.
