I was recently troubleshooting a network connectivity meta-problem, in that I knew a given destination was reachable, but I was not able to demonstrate that with
traceroute because the path went cold after a certain number of hops. Given that the last observed hop was just upstream from the node of interest, I sniffed the traffic, expecting to confirm that the probes were reaching it and to learn which filter rule was blocking them. Sure enough, I learned that the probes were UDP datagrams destined for a high (and varying) port that I had, of course, blocked to inbound traffic.
This surprises me, because I assumed that all
traceroute probes would default to ICMP, since the responses are ICMP. I did a documentation survey and found that different implementations make different choices, and some do not allow the user to make a non-default selection.
The abstract of Traceroute probe method and forward IP path inference supports my intuition that ICMP probes will more often succeed in reaching the destination.
Allowing different probe methods seems like a great idea, but defaulting to something other than ICMP seems like a bad idea. Could somebody describe the rationale behind why it is better to use UDP by default?