From: "Geo" 

"Ellen K."  wrote in message
news:dr8c1117v3gogk0i5qdgti6m35fake7gc6{at}4ax.com...
> This is interesting, so upfront it already actually knows the route
> (based on IP address)?   I imagined it learned each next hop from the
> current one.
>
> But waitaminnit, the internet has dynamic routing, right?   (See, I
> remember stuff I learned here before!!!)   So how can the complete exact
> route be known upfront?

The short version.

Each packet sent across the internet has a Time To Live (TTL) value. If the
packet passes thru a router the TTL is decreased by 1, when it reaches zero
the router that just decreased it to zero trashes the packet and sends an
icmp packet back to the source (time exceeded ICMP packet).

So tracert sends out a packet with a TTL of 1 (or maybe it starts at 2 I
forget), which makes the first router return the timed out message, it then
sends a packet with a TTL of 2 which the second router responds with the
icmp timeout message, it then sends a TTL of 3 and the third router
responds, etc. until it gets to the end and then the receiving end sends
back an ACK saying packet was received ok.

So after this initial burst, tracert knows the IP of every router along the
initial path and it can then start asking DNS to lookup those IP addresses
or whatever else it wants to know about them. It also knows the round trip
time the packet took to go to the router and get back so it can give you
information about where bottlenecks are and such.

You are right though, the routes are dynamic and may change so if you
tracert an hour later it may take a different path. But the path it takes
is usually stable and won't change much unless there is a traffic jam or
something that makes another path faster.

Ok that's the short version, in reality I believe it actually sends out a
bunch of packets with the same TTL instead of a single packet to get the
most likely route and the other stuff has a few more options as well but
you get the basics.

Geo. (cool stuff, huh?)

--- BBBS/NT v4.01 Flag-5