How to interpret this tracerout?

Question

I have a traceroute result that looks like this:

HOST: local                       Loss%   Snt  Last   Avg  Best  Wrst StDev
  1.|-- 10.0.1.1                  0.0%    10    1.2  10.2   1.1  32.1  10.9
  2.|-- 111.111.11.21             0.0%    10    3.4  47.6   2.6 331.0 102.6
  3.|-- bt-128-389.bta.net.cn     0.0%    10    4.5  11.9   4.5  25.9   7.4
  4.|-- 124.65.28.229             0.0%    10    7.7  12.1   4.1  35.8   9.5
  5.|-- 152.75.194.93             0.0%    10   11.0  17.3   6.2  35.7  10.3
  6.|-- 219.111.6.110             0.0%    10   44.4  46.8  39.4  55.8   5.1
  7.|-- 119.138.23.25             0.0%    10   56.4  68.2  51.1 110.3  19.5
  8.|-- 212.111.96.222            0.0%    10   54.0  65.8  54.0  88.6  13.2
  9.|-- 189.158.97.242            0.0%    10   61.3  71.2  51.5  98.4  18.1
 10.|-- 231.158.40.102           10.0%    10   54.4  67.4  47.0  93.8  16.8
 11.|-- 118.188.104.14            0.0%    10   54.0  66.7  45.6 103.6  19.7
 12.|-- 116.151.36.153            0.0%    10   61.4  68.9  50.2 103.9  15.9
 13.|-- ???                      100.0    10    0.0   0.0   0.0   0.0   0.0
 14.|-- 57.30.49.32              10.0%    10   54.5  68.9  46.2 102.1  20.1

I don't understand:

1. why is the avg connection time lower at hop 3-5 than 2? (since hop 3-5 is further away, how come it is faster to connect to them than hop 2?)
2. At hop 13, if that hop drops all the packets, then how did I connect to hop 14 eventually? (Does that mean hop 13 doesn't respond to ICMP but still forwarded the packets to hop 14?)

Answer 1

First you need to understand how tracert works.

tracert sends individual packets to the destination with a increasing Time To Live. each router decrements TTL and when it reaches 0, the router will usually send an ICMP TTL Exceeded message back to the host. so to test the first hop, the TTL is 1 (which the router decrements and immediately sends back a TTL exceeded)), the second hop uses 2, and so on.

so, for Hop 13, the device is configured not to send TTL exceeded messages. tracert just waits until the timeout is reached, increments TTL, and tries the subsequent hop.

As for your time variance, note that the average is high because the "worst" was a whopping 331ms, but your "best" is only 2.6, and the standard deviation is huge, indicating that your "average" is based on figures that vary widely (like 2.6 and 331). I'd say hop two was just having a bad half second.