On Unix, Linux, and OS X systems, traceroute sends UDP datagrams to high-numbered ports with an increasing time to live (TTL) value. The first datagram sent has a time to live of 1. Each network hop, e.g. a router, along the path of a UDP datagram or TCP packet to its destination will decrement the TTL value by 1 and, unless the system is the final destination, will send an ICMP error datagram (11 - Time Exceeded) back to the source system, if after it decrements the TTL the TTL value is 0.
As an example, suppose you are performing a traceroute between two computers with two routers between the source and destination systems as in the diagram below.
When you issue the command traceroute workstation2, the
traceroute command will first send out a UDP datagram with a TTL of 1.
Router 1 will decrement the TTL, at which point it becomes 0, so router 1 sends
an ICMP "time exceeded" datagram back to workstation 1. Workstation 1 then
sends another datagram to workstation 2, but this time with a TTL of 2. Router
1 is the first hop on the path to workstation 2 and it decrements the TTL
and sends it on to router 2 which also decrements the TTL at which point it
is now 0, so router 2 sends back a "time exceeded" datagram to workstation 1.
Then workstation 1 sends a datagram with a TTL of 3. This time the TTL is
decremented to 2 at router 1 and then to 1 at router 2, which sends the
datagram on to workstation 2, which is the destination system that will send
a reply back to workstation 1. On Microsoft Windows systems, the tracert
command uses a similar process except it sends ICMP echo requests, instead of
UDP packets to a high-numbered port.
Another tool available for use on Microsoft Windows systems is tcproute. Tcproute sends TCP packets to port 80 on the destination system, increasing the TTL value by one with each packet sent, so the tool is similar to the process employed by traceroute on Unix, Linux, or OS X systems, though it is using TCP rather than UDP and is using a destination port of 80, the default port used by web servers for Hypertext Transfer Protocol (HTTP) traffic.
[ More Info ]
