I'm really confused on how traceroute works, I read online that Traceroute uses ICMP messages and TTL fields in the IP header for its operation and transmits packets with small TTL values.
I did
test 1: traceroute <"domain">
traceroute was never able to map the final destination
test 2: traceroute -I -IP icmp <"domain">
the final destination was mapped but the confusion in all this is WHY ?, I thought Traceroute already uses ICMP.
Different tracroute implementations use different packets. Typically, either UDP or ICMP, although TCP traceroute exists as well.
You were probably using some UDP implementation.
Traceroute works by taking advantage of a feature called time-to-live (TTL), which is the number of hops a packet can take before it stops being retransmitted. The TTL is decremented by 1 for each hop the packet traverses. When the TTL reaches zero, the router on which it reached zero will send back an ICMP Time Exceeded packet to the source, rather than retransmitting the packet. The source (i.e. you) will then receive this packet from the router at which the original packet's TTL reached zero, and thus you'll know the IP address at which the packet failed. Traceroute works by sending out packets towards the destination with successively larger TTLs. This way, you'll get ICMP Time Exceeded packets for each hop on the path between you and the destination, because you'll have a packet reaching a TTL of 0 at each hop. Now notice that nowhere here do we mention the protocol you're using to send your packets. TTL is in the IP header, which encapsulates the packet for the protocol you're using. Thus, you can use whatever protocol you want when tracerouting.
As for why traceroute hops resolve for some protocols and don't for others, its likely firewalls as well as policies on the routers you're traversing. Some routers either de-prioritize responding to ICMP, or have ICMP disabled. There's all sorts of reasons why some protocols happen to work better than others in a given case.
