In Linux, by default, traceroute uses UDP packets with a large destination port number (33434 – 33534) that is unlikely to be used by any application at the destination host. TTLs are used to get the IP addresses of the intermediary routers.

What protocol does traceroute use?

A traceroute works by sending Internet Control Message Protocol (ICMP) packets, and every router involved in transferring the data gets these packets. The ICMP packets provide information about whether the routers used in the transmission are able to effectively transfer the data.

Is traceroute ICMP or TCP?

Plain traceroute uses either UDP packets, or ICMP “Echo” packets, both kinds being routinely blocked by (over)zealous sysadmins. tcptraceroute instead uses a TCP “SYN” packet, i.e. the kind of packet that would occur as first step in the TCP “three-way handshake”.