Concerning trace routes

The Internet is a large and complex aggregation of network hardware connected together by gateways. Information sent over the Internet is broken down into formatted blocks of data called packets. Each packet contains a “time-to-live” value. Most packets originating from computers running Windows NT or later are sent with a TTL value of 128.

Every time a host forwards a packet, it decrements the TTL value of the packet by one. If the TTL value of a packet is zero and it has yet to reach its destination, the packet is discarded and the host will send a response back to the sender notifying them that the destination was not reached. This prevents packets from endlessly looping around the Internet, never finding their destination. Nowadays, it is considered worst case scenario if a packet passes over 40 hops to reach its destination.

A “trace route” works by increasing the TTL value of each successive packet sent. The first packet is sent with a TTL value of one (implying that it will make a single hop). The next packet has a TTL value of two, and so on. By doing so, a destination unreachable response packet is elicited from each hop. These returning packets are used to produce a list of hosts that the packets have traversed en route to the destination.

Unfortunately for those performing trace routes, sometimes hosts will just drop the last packet and not return a destination unreachable response. This ultimately means that it is impossible to always perform an accurate trace route.

It is important to note that Internet Protocol (IP) does not guarantee that all the packets take the same route.