Traceroute with Nmap

• --traceroute
• Determines what sort of probe will be most effective based on scan results
• - ICMP | TCP specific port | UDP specific port
• Sends probes in parallel
• “goes backwards” for efficiency
• Sends probe with high TTL based on guess derived from scan results so far and determines exact number of hops
• - If response from end host, lowers TTL
• - If ICMP Time Exceeded message, raises TTL