Many people have used traceroute in their lives, but it seems like very few know what traceroute actually does or how it works.

Let's look at a normal IPv4 packet. There is a bunch of information in the packet header, one of which is a TTL, or time to live. Originally, every time that a packet was looked at by a router, the router was supposed to decrement the TTL by how many seconds the router "had" the packets. The newer RFC's now say that TTL should be decremented by one every time a router touches the packet.

Okay, now that we've gotten that out of our way, lets explain traceroute. First it finds the IP address of the machine we are trying to traceroute to, then we send a packet to the IP address and set the TTL to 1. So what happens is that the packet tries to route the packet to the first router. The first router sees that the TTL is one, decrements the TTL by one, then sees that the TTL is now zero. The router now sends a ICMP packet back to the source saying that the time exceeded. This gives your traceroute client the first hop. Now change the TTL to two and send the packet. It goes past the first router, it decrements the TTL by one, which makes the TTL now one, and into the next router the packet goes. The TTL is again decremented by 1 by the second router. The router sees this packet now as a TTL of zero, and again sends an ICMP packet back to the source saying that the time exceeded. This continues on until the packet doesn't get returned or the packet gets to it's destination.

Hopefully I've explained this well, but if not, msg me and let me know. Happy tracerouting.