Hello Rahsin,
Traceroute is a simple ICMP Echo/Echo Reply packet with its Time To Live (or Time to Life) field (TTL) increased by one, for every ping reply (echo reply) it receives.
For example, when you traceroute to a specific IP address, an ICMP echo is sent with a TTL =1. When the reply comes back, your machine will send another ICMP echo to the same IP address, but this time the TTL is set to 2. As the packet passes the first router (e.g your gateway), the TTL is decremented by 1, so when it reaches the second hop, TTL is already equal to 1. The second router will decrement it to zero (0) and then return the packet back with an ICMP echo reply.
The same logic is applied until the packet reaches its final destination.
You can see the ICMP echo/echo reply packet structure on this article:
www.firewall.cx/networking-topics/protoc...-icmp-echo-ping.html
Hope that helps clear things up.
Please let us know if you have any additional questions.
Many thanks.
Chris.
