UDP Traceroute to Bypass ICMP Blocking
A Certified Ethical Hacker is attempting to gather information about a target organization's network structure through network footprinting. During the operation, they encounter ICMP blocking by the target system's firewall. The hacker wants to ascertain the path that packets take to the host system from a source, using an alternative protocol. Which of the following actions should the hacker consider next?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of traceroute alternatives; the common trap is choosing standard ICMP tools that fail against strict firewall rules.
This page explains how a Certified Ethical Hacker can use UDP Traceroute to map network paths when ICMP is blocked by firewalls. It establishes why option A is the correct technical action.
Learners often choose ICMP Traceroute (Option B) because it is the default on Windows, failing to realize that ICMP packets are explicitly blocked by the target's firewall.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
When ICMP echo requests are blocked by a firewall, an ethical hacker must switch protocols to discover the route. In Linux, thetraceroute command defaults to sending UDP packets to high-numbered ports (typically starting at 33434). This method (Option A) works because many firewalls allow outbound UDP traffic for legitimate services or do not block the specific high-port range used by traceroute as aggressively as they block ICMP. The destination host or intermediate routers respond with ICMP 'port unreachable' messages, allowing the path to be mapped.Why the Other Options Are Wrong
Option B (ICMP Traceroute on Windows) uses thetracert command which relies entirely on ICMP Echo Requests. Since the scenario states ICMP is blocked, this tool will fail to receive responses and cannot determine the path. Option C (ARIN Whois) provides registration data about IP ranges but does not trace the actual network path or hops taken by packets. Option D (Path Analyzer Pro) is a generic third-party tool name and not a standard protocol-based action like using UDP via the command line.Community Comment Notes
Community consensus strongly supports Option A. Users noted that UDP is often less filtered than ICMP in modern security configurations. One commenter highlighted that Linuxtraceroute sends to high ports specifically to bypass such restrictions, while another confirmed that UDP traceroute is the standard alternative when ICMP is unavailable. Exam Strategy
Always check the protocol constraints in the scenario. If ICMP is blocked, immediately consider UDP or TCP-based alternatives for network discovery tools like traceroute.
Frequently Asked Questions
Why does UDP Traceroute work when ICMP is blocked?
Firewalls often block ICMP Echo Requests strictly but may allow UDP traffic to high-numbered ports used by traceroute, or simply drop them without generating blocking signals, allowing hop-by-hop discovery via ICMP Port Unreachable replies.
Can I use TCP Traceroute instead of UDP?
Yes, some tools support TCP traceroute (e.g., using port 80 or 443), but the standard Linux traceroute utility defaults to UDP unless specified otherwise, making Option A the most direct answer for the described environment.