...

talking about ICMP echos with varying TTL and routers sending back ICMP echo-replies. I wanted to end the interview and hire him on the

If that would be the criteria, wouldn´t the acceptable answer involve UDP packets and ICMP time exceeded? (not counting windows way of doing traceroute)

Little details like that can be sorted out later by education. In fact, the individual that I'm thinking of may have mentioned UDP packets. The point is that the answer shows the kind of detailed understanding of the network that you want in a network engineer. This guy wasn't just a user of tools that do stuff, he understood what was happening inside the network layers themselves. There are lots of people who know how to use traceroute or Infovista but you wouldn't want them logging into your core routers for troubleshooting. --Michael Dillon