How Traceroute Uses UDP for Network Diagnostics

Traceroute is a foundational network diagnostic tool used to map the path packets take across an IP network and measure transit delays. While the tool relies on Internet Control Message Protocol (ICMP) error messages to report path data, many implementations—particularly on Unix-like operating systems such as Linux and macOS—use User Datagram Protocol (UDP) packets as the primary probing mechanism. By systematically incrementing the Time-to-Live (TTL) values of UDP packets sent to intentionally invalid high-numbered ports, Traceroute prompts intermediate routers and the final destination to return ICMP messages that reveal the network path step by step.

The Time-to-Live (TTL) Mechanism

Every IP packet includes a Time-to-Live (TTL) field in its header, designed to prevent packets from looping endlessly across networks. Each router that forwards a packet decrements its TTL value by one. If a router receives a packet with a TTL of 1 and attempts to forward it, the TTL drops to 0. The router then drops the packet and sends an ICMP Time Exceeded (Type 11) message back to the source IP address.

Traceroute exploits this mechanism using UDP packets:

1. Hop 1: Traceroute sends a UDP packet with a TTL = 1. The first router decrements the TTL to 0, drops the packet, and returns an ICMP Time Exceeded message. Traceroute records the router’s IP address and calculates the round-trip time (RTT).
2. Hop 2: Traceroute sends a UDP packet with a TTL = 2. It passes the first router (which decrements TTL to 1) and reaches the second router, where the TTL drops to 0, triggering another ICMP Time Exceeded message.
3. Subsequent Hops: The process repeats with incrementing TTL values (TTL = 3, TTL = 4, and so on) until the destination host is reached.

Identifying the Destination with High-Port UDP

To distinguish between an intermediate router and the final destination, UDP-based Traceroute sends packets to destination port numbers that are unlikely to be in use. Typically, implementations start sending to port 33434 and increment the port number with each subsequent probe.

When the packet reaches the target destination: * The destination host does not drop the packet due to an expired TTL. * The host attempts to deliver the UDP payload to the specified high-numbered port. * Because no service is listening on that port, the destination’s operating system generates an ICMP Destination Unreachable / Port Unreachable (Type 3, Code 3) error message and sends it back to the source.

Receiving a “Port Unreachable” message signals to Traceroute that the probe has successfully reached the final destination host, concluding the trace.

Why UDP Is Used Instead of Direct ICMP

While Windows implementations (such as tracert) historically use ICMP Echo Request packets by default, standard Unix/Linux traceroute relies on UDP for several reasons:

• Distinction of Completion: The transition from receiving ICMP Time Exceeded errors (intermediate hops) to an ICMP Port Unreachable error (target host) provides an unambiguous signal that the final endpoint has been reached without needing an active application listening on the target.
• Firewall Behavior: Some network configurations and firewalls block incoming ICMP Echo Requests (ping) to obscure host presence, but they may still respond to UDP traffic with standard ICMP port unreachable messages.
• Granular Tracking: By using distinct UDP source and destination port pairs for each probe, the diagnostic tool can easily correlate returning ICMP error packets with the exact outbound probe, allowing precise multi-probe RTT measurements.