Once the agent's TCP or ICMP packets reach the target (18.104.22.168, lb-c1.thousandeyes.com), the returned packets are no longer ICMP Time-to-Live Exceeded packets. The target responds with TCP SYN-ACK or ICMP Echo Reply, depending on the packets initially sent by the agent. The firewall in this example can statefully associate these returned packets with the initial packets sent by the agent, and permits them to reach the agent. This is seen in hop #7 of the Path Visualization graph - the target node. From this information, the Path Visualization can tell that there are six prior hops, although the responses from those hops never reached the Enterprise Agent, hence the nodes being rendered in white (no node information).