How is it possible that a subsequent hop takes less time than the previous in traceroute?

Question

This is a noob question, but I'm pretty sure serverfault is the best place to ask it. I understand traceroute and what it does, but I don't understand the response times.

for example here I'm tracerouting to cnn.com, but hop 5 takes 32ms and hop 6 only 11ms. Doesn't the packet have to go through the router at 5 to get to 6 and come back? Or does the packet take a different route to get to 6 the next time?

4  gig-3-0-0-nycmnyrdc-rtr01.nyc.rr.com (24.29.157.197)  11.482 ms  9.982 ms  11.259 ms
 5  tenge-0-0-0-nycsnyoo-rtr1.nyc.rr.com (24.29.119.102)  32.916 ms  13.796 ms  11.527 ms
 6  66.109.6.76 (66.109.6.76)  11.558 ms  10.471 ms  11.295 ms
 7  ae-0-0.pr0.nyc30.tbone.rr.com (66.109.6.159)  14.572 ms  11.505 ms  59.635 ms
 8  xe-9-0-0.edge2.newark1.level3.net (4.59.20.29)  13.848 ms  13.372 ms  16.891 ms
 9  ae-32-52.ebr2.newark1.level3.net (4.68.99.62)  22.635 ms  14.799 ms  16.064 ms
10  ae-4-4.ebr2.washington1.level3.net (4.69.132.101)  21.666 ms  15.879 ms  16.639 ms
11  ae-82-82.csw3.washington1.level3.net (4.69.134.154)  20.728 ms
    ae-62-62.csw1.washington1.level3.net (4.69.134.146)  21.352 ms  29.861 ms

Answer 1

What you're missing is the fact that the hop where the ICMP packets are directed has to respond to those ICMP packets. When you start the trace, the first hop has to respond to the packets directed to it, then the second hop responds to the packets directed to it while the first hop merely passes these packets through to the second hop. The difference you're seeing is the difference in time that each hop is responding to the packets that are directed to it. Hop 5 is taking more time to respond to the ICMP packets than hop 6 is.

Generally speaking, trace route is a good tool for determining the path to a destination but not a very good tool for determining the quality of that path.

Answer 2

It does, but times to destinations can vary. Each time another line shows up on the output, a new packet/set of packets have been sent out, each with an increasing TTL value.

For example:

 1st run: 1st hop -> report back
 2nd run: 1st hop -> 2nd hop -> report back
 3rd run: 1st hop -> 2nd hop -> 3rd hop -> report back
 ...

and so on.

Thus, you can get variations if the 1st hop takes 10 ms on the first run but only 2 ms on the next run.

Reference: http://en.wikipedia.org/wiki/Traceroute