A couple of things listed in this Forum I want to make sure I understand…
In the following:
“So by default, ping uses ICMP on top of IP (layer 3), traceroute uses UDP (layer 4) on top of IP. But ultimately, ICMP still remains a strictly layer three protocol.”
Did it intend to say traceroute still remains a strictly layer three protocol?
Also, these statements seem to contradict. I believe the first one is correct that a Cisco tracroute will start with a destination UDP port of 33434 instead of a random port number?
“The default implementation of traceroute sends a sequence of UDP packets, with destination port numbers ranging from 33434 to 33534. This is how the Cisco implementation works by default.”
“You are correct in your understanding Cisco’s use of UDP. Cisco picks a random destination UDP port and once the packet arrives at the intended target, the target replies back with a Type 3 ICMP (Destination Unreachable) because it is likely that the target device does not have the randomly chosen UDP port open.”