How traceroute actually discovers each hop

Traceroute works by sending a series of probe packets with a deliberately limited Time-To-Live (TTL) — starting at 1 and incrementing by one for each round. Every router a packet passes through decrements its TTL by one, and a router that receives a packet with TTL already at zero drops it and sends back an ICMP "time exceeded" message identifying itself. By sending one probe at TTL=1, then TTL=2, then TTL=3, and so on, traceroute forces each successive router along the path to reveal itself one hop at a time — that's the entire mechanism, and it's also exactly why traceroute inherently takes longer than a single ping: it needs one full round trip per hop, times however many hops the target actually is away.

Why a "*" at one hop usually isn't the actual problem

Many routers are configured to deprioritize or simply not respond to the ICMP messages traceroute depends on, whether for security reasons or just to reduce load from constant probe traffic — that router will show as `*` (timeout) in the trace while still forwarding traffic completely normally. This is extremely common on hops belonging to networks that aren't the source or destination of the query, and the only way to tell whether the path is actually broken there or the hop is just silent is to keep reading: if later hops beyond the `*` continue to respond normally, the path is fine and that one hop is just non-responsive to traceroute specifically, not evidence of an actual routing problem.