ICMP (Internet Control Message Protocol)

Hello Eliu

Your observation is well taken, and thank you for pointing that out. I should have been clearer in my explanation. You will notice that there is no UDP information in any of the captures that have to do with the ping command while you will see the UDP line as well added to that for any of the captures that have to do with traceroute. Ping does not include layer 4 however, traceroute incorporates layer four, specifically UDP in order to achieve its functionality.

The default implementation of traceroute sends a sequence of UDP packets, with destination port numbers ranging from 33434 to 33534. This is how the Cisco implementation works by default.
However, the implementations of traceroute on other platforms can vary. For example, traceroute shipped with Linux and macOS based operating systems includes an option to use ICMP Echo Request packets instead of UDP, or even any arbitrary protocol such as UDP or TCP using TCP SYN packets. In Windows, traceroute uses ICMP echo requests instead of UDP packets.

So by default, ping uses ICMP on top of IP (layer 3), traceroute uses UDP (layer 4) on top of IP. But ultimately, ICMP still remains a strictly layer three protocol.

I hope this has been helpful!

Laz

2 Likes