ICMP (Internet Control Message Protocol)

Hello Abdul

Regular IP packets have a TTL field in their headers that is typically set to 255 (or some other number depending on the operating system of the particular device). The TTL is decremented every time it passes through a router. The purpose of the TTL is to ensure that if this packet gets caught in a routing loop, it will not be routed forever, but when TTL=0 it will be dropped.

Traceroute takes advantage of this TTL feature to be able to perform its function. Traceroute will send a series of packets to get a response from each router along the path.

To do this, traceroute will not start with a TTL of 255 but it starts by sending one packet with a TTL of 1. This will reach only the next router, and will not go further, because TTL reaches 0 at that point. BUT, that router will send a response saying “I got your packet, it reached a TTL of 0”.

Next it sends another packet with a TTL of 2. It goes to the first router, TTL is decremented by 1, and goes to the second router, where TTL reaches 0. BUT, that router will send a response saying “I got your packet, it reached a TTL of 0”

Next it sends another packet with a TTL of 3… and so on.

You can see a visual representation of this in the following post as well:

So each packet that traceroute sends is decremented by 1 by each router it goes through, but the next packet that is sent will increase the initial TTL by 1 so that it can reach the very next router in the sequence.

I hope this has been helpful!

Laz