Client will use TTL set to 1 first and send ICMP Echo request message. First Router will find TTL expired and returns the ICMP Time exceeded message. it will encapsulates the original IP and ICMP payload in new IP and ICMP payload. That way client learns its first route. Next time it sets the TTL is set to 2 and same process repeats. Untill we locate the destination address