How does traceroute work, and what role does the TTL field play?

Traceroute answers "what path does my traffic take to reach this host, and where is it slow or broken?" It's a clever hack on a field that exists to prevent routing loops: the TTL. Understanding it proves you understand how routers and ICMP behave.

The TTL trick

Every IP packet carries a Time To Live value. Its real job is loop prevention: each router that forwards a packet decrements TTL by 1, and when TTL reaches 0, the router discards the packet and sends back an ICMP Time Exceeded message to the source.

Traceroute weaponizes this on purpose:

1. Send a probe with TTL = 1. The first router decrements it to 0, drops it, and replies with Time Exceeded — now you know hop 1.
2. Send a probe with TTL = 2. It survives the first router and dies at the second, which replies — now you know hop 2.
3. Keep incrementing. Each round reveals the next router in the path, in order, along with round-trip timing.

Reaching the destination

Intermediate hops reply with Time Exceeded. The final destination is detected differently: depending on the variant, it replies with ICMP Echo Reply (ICMP probes), ICMP Port Unreachable (classic UDP probes to a high port), or a TCP SYN-ACK/RST (TCP probes). That different response is how traceroute knows it has arrived.

Reading the output

Asterisks (* * *) mean no reply for that hop — often a router configured not to send ICMP, a firewall dropping probes, or rate limiting. They don't necessarily mean a broken path. Variable timing or a sudden jump can point to congestion or a long-haul link.

Interviewers want the increasing-TTL mechanism, the ICMP Time Exceeded reply, and ideally why some hops show no response.