How does tracert (or traceroute) actually discover the hops between you and a destination?

It abuses the TTL field in IP — sending packets with TTL=1, 2, 3, … and collecting the "Time Exceeded" errors that come back from each router along the path.

The TTL trick:

Every IP packet has a Time To Live (hop counter):

1. Each router decrements TTL by 1
2. If TTL hits 0, the router drops the packet and sends back an ICMP "Time Exceeded" (Type 11)

How tracert exploits this:

TTL=1 → first router drops it, sends ICMP TimeExceeded → you learn hop 1's IP
TTL=2 → second router drops, sends TimeExceeded       → you learn hop 2's IP
TTL=3 → third router drops, sends TimeExceeded        → you learn hop 3's IP
...
TTL=N → reaches destination, gets actual reply        → done!

Why 3 packets per hop:

Default tracert sends 3 probes per TTL to:

• Get statistical timing — compute min/avg/max RTT for each hop
• Survive packet loss — if one of the three is dropped, the others still reveal the hop
• Detect path variability — if hop 5 alternates between two routers (load balancing), you'll see both

Windows vs Linux:

Limits:

• Default max hops: 30 (-h to change)
• Some hops show * — the router doesn't send Time Exceeded (filtered) but the packet still passes through

Tip: Compare tracert google.com from home WiFi vs cellular. You'll see your ISP, peering points, and Google's edge — a free geography lesson about how the internet actually routes.

Go deeper:

• Traceroute (Wikipedia) — the TTL trick in detail, plus why load-balanced paths confuse it and how Paris-traceroute fixes that.