Traceroutes. Peering information is also often public. More sinister options like insider information or leaked/exfiltrated network plans are also an option, b

Traceroutes. Peering information is also often public. More sinister options like insider information or leaked/exfiltrated network plans are also an option, but usually you get pretty far with standard network diagnostic tools.