How exactly does traceroute/tracert work at the protocol level?

Traceroute application sends series of ICMP echo requests to the destination IP with initial TTL field (in IP header) =1. by doing so, the application will receive ICMP Time Exceeded message from the first router.

Then it will send ICMP echo request with TTL=2 and will get ICMP Time Exceed message from the second hop, and so on till reaching the final host.

Traceroute command work at Layer3 of the OSI model, traceroute operates like ping and uses the services of the ICMP protocol.

windows

A 'traceroute' is a linux/unix based command has been using for tracing a network/host.For windows, you should use 'tracert'.

Traceroute gives you details about how many routers(It says hops) you need to accross to reach that specific host/network.

The most important thing I want to mention is :

'Traceroute' and 'Tracert' do not work in same way but their objective is the same.

Traceroute is a linux/Unix or some OS based.Traceroute uses specific port for its operation.

Traceroute uses UDP 33434 to33534 port for echo request(Type8)

Tracert uses ICMP.

For windows you can use another command "pathping' that will also show all the hops with detail information.