There are a couple of details about Herman that you should know. And they relate to how packets of data travel around the Net.
Remember that a data packet, when packaged for travel to another computer on the Net, has a header that contains certain information. Among this information is the source IP address, and the destination IP address. The source is where the data comes from, and the destination is where the data packet is supposed to go.
The Net uses the destination IP address to route (send) the data to its destination. The routers keep track of paths to various destinations, so they know how to get the data there. If the data doesn't arrive in a certain amount of time, the router will send a message back to the source IP address saying, in effect, "I didn't get the data packet to it's destination, so it might be lost, so you need to send it again." So if the data somehow gets to a 'dead' router, or one that is not working properly, the data will get resent, and eventually get to it's destination.
Most data gets where it needs to go. The Net doesn't really care about the path from start to finish, just that it gets there. A data packet sent to the same location may travel one path one time, and probably another path the next time. But the data gets there.
And the Net doesn't keep track of the path of the data. It doesn't even care about the source of the data. The Net just wants to deliver the data to it's destination.
And that's what Herman (and I) know. The data source is not important to my investigation of the viral routers. Only the destination of the data that is copied by the viral router is important.
When Herman finds a system with a viral router, he sends a short alert packet to one of my bogus email accounts. A few short bytes of information is all that I need to know where the viral router is. That information is forwarded through several anonymous email accounts back to one special account.
Then Herman waits in memory, watching all router traffic, waiting for it's special command to wake up.