Networks Security Interview Question:

Explain How does traceroute work? Now how does traceroute make sure that the packet follows the same path that a previous (with ttl - 1) probe packet went in?

Submitted by: Administrator

First of all see traceroute works using ICMP packets. First source sends an ICMP packet with Time to Live (TTL) field as 1 to the destination address. Now intermediate router receives the packet and sees that TTL field has expired, so it sends a ICMP TTL expired reply. Now the source machine again sends the ICMP packet with TTL field as 2. This time second intermediate router replies. This process is repeated till destination is reached. That way the source can get the entire route upto destination.
Submitted by: Administrator

This answer is not complete, the fact is linux machines use udp with destination port: 33434 and this des port will be incremented along with the TTL value, and windows use ICMP echo request, i.e ICMP type 0 and the reply after ttl expiration at each hop will be ICMP type 12 packet.
Submitted by: Syed