UDP Traceroute to Bypass ICMP Blocking

312-50v12 By islever Editorial Last updated

Scanning Networks

Short answer

A Use UDP Traceroute in the Linux operating system by executing the 'traceroute' command with the destination IP or domain name.

Question

A Certified Ethical Hacker is attempting to gather information about a target organization's network structure through network footprinting. During the operation, they encounter ICMP blocking by the target system's firewall. The hacker wants to ascertain the path that packets take to the host system from a source, using an alternative protocol. Which of the following actions should the hacker consider next?
  1. Use UDP Traceroute in the Linux operating system by executing the 'traceroute' command with the destination IP or domain name. Correct Answer
  2. Use the ICMP Traceroute on the Windows operating system as it is the default utility.
  3. Use the ARIN Whois database search tool to find the network range of the target network.
  4. Utilize the Path Analyzer Pro to trace the route from the source to the destination target systems.

Key Takeaways

The question tests knowledge of traceroute alternatives; the common trap is choosing standard ICMP tools that fail against strict firewall rules.

This page explains how a Certified Ethical Hacker can use UDP Traceroute to map network paths when ICMP is blocked by firewalls. It establishes why option A is the correct technical action.

Common mistake: Learners often choose ICMP Traceroute (Option B) because it is the default on Windows, failing to realize that ICMP packets are explicitly blocked by the target's firewall.

Expert Analysis

Why the Answer Is Correct

When ICMP echo requests are blocked by a firewall, an ethical hacker must switch protocols to discover the route. In Linux, the traceroute command defaults to sending UDP packets to high-numbered ports (typically starting at 33434). This method (Option A) works because many firewalls allow outbound UDP traffic for legitimate services or do not block the specific high-port range used by traceroute as aggressively as they block ICMP. The destination host or intermediate routers respond with ICMP 'port unreachable' messages, allowing the path to be mapped.

Why the Other Options Are Wrong

Option B (ICMP Traceroute on Windows) uses the tracert command which relies entirely on ICMP Echo Requests. Since the scenario states ICMP is blocked, this tool will fail to receive responses and cannot determine the path. Option C (ARIN Whois) provides registration data about IP ranges but does not trace the actual network path or hops taken by packets. Option D (Path Analyzer Pro) is a generic third-party tool name and not a standard protocol-based action like using UDP via the command line.

Community Comment Notes

Community consensus strongly supports Option A. Users noted that UDP is often less filtered than ICMP in modern security configurations. One commenter highlighted that Linux traceroute sends to high ports specifically to bypass such restrictions, while another confirmed that UDP traceroute is the standard alternative when ICMP is unavailable.

Exam Strategy

Always check the protocol constraints in the scenario. If ICMP is blocked, immediately consider UDP or TCP-based alternatives for network discovery tools like traceroute.

Frequently Asked Questions

Why does UDP Traceroute work when ICMP is blocked?

Firewalls often block ICMP Echo Requests strictly but may allow UDP traffic to high-numbered ports used by traceroute, or simply drop them without generating blocking signals, allowing hop-by-hop discovery via ICMP Port Unreachable replies.

Can I use TCP Traceroute instead of UDP?

Yes, some tools support TCP traceroute (e.g., using port 80 or 443), but the standard Linux traceroute utility defaults to UDP unless specified otherwise, making Option A the most direct answer for the described environment.

More 312-50v12 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 2 Answered A
    A. Use UDP Traceroute in the Linux operating system by executing the 'traceroute' command with the destination IP or domain name. When ICMP is blocked by a firewall, you can use alternative protocols like UDP for tracerouting. In Linux, the 'traceroute' command allows you to specify the UDP protocol using the '-U' option.
  2. LordXander 👍 2 Answered A
    UDP..because most defences are not configured for UDP (don't ask how I know that)
  3. Mos3ab 👍 1 Answered A
    The traceroute utility in Linux, by default, sends UDP packets to high-numbered ports (starting at 33434) and listens for ICMP "port unreachable" messages from the destination. This method can bypass ICMP blocking since it doesn't rely on ICMP echo requests for its operation. By executing traceroute [destination IP/domain], you can trace the route packets take to the target system.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide