GSEC · Question #129
The Windows 'tracert' begins by sending what type of packet to the destination host?
The correct answer is A. A UDP packet with a TTL of 1. Windows tracert maps the path to a destination by sending probe packets with a starting TTL of 1, incrementing by one per round-trip so each intermediate router returns an ICMP Time Exceeded message revealing that hop.
Question
The Windows 'tracert' begins by sending what type of packet to the destination host?
Options
- AA UDP packet with a TTL of 1
- BAn ICMP Echo Request
- CAn ICMP Router Discovery
- DAn ICMP Echo Reply
How the community answered
(56 responses)- A79% (44)
- B7% (4)
- C13% (7)
- D2% (1)
Why each option
Windows tracert maps the path to a destination by sending probe packets with a starting TTL of 1, incrementing by one per round-trip so each intermediate router returns an ICMP Time Exceeded message revealing that hop.
tracert sends probe packets with an initial TTL of 1 so the first router decrements the TTL to zero, drops the packet, and returns an ICMP Time Exceeded message identifying that hop. The TTL is then incremented by one for each subsequent round until the destination is reached, tracing the full path. On Unix-based systems this behavior uses UDP probes by default, and the question reflects that underlying probe-packet mechanism starting at TTL 1.
An ICMP Echo Request is the packet type used by the ping utility to test reachability, not the initial probe packet sent by tracert to elicit TTL-exceeded responses from routers.
ICMP Router Discovery (IRDP) is used by hosts to locate default gateways on a local network and has no role in hop-by-hop path tracing.
An ICMP Echo Reply is the response a destination sends back to a ping request - tracert sends outbound probe packets, not replies.
Concept tested: tracert TTL-based hop discovery mechanism
Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tracert
Topics
Community Discussion
No community discussion yet for this question.