From: John Beckett 

"Geo"  wrote in message
news::
> Ok that's the short version, in reality I believe it actually sends out a
> bunch of packets with the same TTL instead of a single packet to get the
> most likely route and the other stuff has a few more options as well but you
> get the basics.

Tracert starts by sending a single packet with TTL = 1. It waits for a
reply, then repeats the send/wait for a total of three times. Then it
increments the TTL and tries again.

Each reply causes tracert to display the IP and name of the answering
router. The name comes from a DNS reverse query. That can add quite a long
delay before the name is actually displayed. You probably know you can use
the -d option to skip the name lookups:

tracert -d cisco.om

Tracert does everything one-step-after-the-other. Bear in mind that the
old-time authors of network testing tools are very conscious of the fact
that they are using other peoples systems. Therefore, standard stuff like
tracert does not flood the network.

John

--- BBBS/NT v4.01 Flag-5