When tracing a route, devices reveal their interface addresses: a router whose TTL expires sends ICMP Time Exceeded, while the destination host replies to the probe itself with ICMP Destination Unreachable, SYN-ACK, or TCP RST, depending on its type. The “Screamer” tool covered in this article uses this mechanism to perform reconnaissance based on TTL tracing and build a network graph without excessive scanning.