We've spoken quite a bit about these elusive UDP
traceroute probes in past clips.
Having just completed some traceroutes in the
Globomantics network, it's time to dig deeper.
There are three UDP probes here.
Each one has a TTL of 1, which indicates all three probes were
sent to discover the first hop in the network.
We are not going to dig into the ICMP TTL exceeded packets in this clip,
but you can clearly see them interwoven in between the traceroute UDP
probes. Each time the Globomantics router connected to the client running
traceroute received one of these UDP probes with a TTL of 1, it
immediately replied by notifying the sender about having insufficient
postage to use our earlier post office example. Each one has a different
UDP port number.
This creates uniqueness between each probe. The ports increment by one,
starting from 33434 for each probe sent. Because traceroute is sending
three probes per hop, you can calculate what the port numbers would be
for any arbitrary number of hops. We already know the target won't be
listening on them.
It may not seem relevant now, but the checksum of a035 will appear again soon.
Just make a mental note for now.
It's also worth noting that these packets do not have any payloads.
There is no reason for them to carry any data.
Think back to the ICMP echo‑request and echo‑reply deep dives.
Why did those packets have payloads? First, we could use ICMP ping to test
the quality of our links by telling the client to check all the payload
data to ensure it was transferred successfully.
Second, ICMP pings can be variable in size,
which is accomplished by varying the payload size.
Neither of these techniques is meaningful for traceroute,
so the traceroute designers wisely omitted them.
Let's move on to examining the TTL exceeded packet. This one is fun, I promise.