After the attacker run tracert on a destination server ... how does he
know what is the device in between - whether is it a switch, hub or
router? How can he differentiate it?