Unlike listening TCP ports that respond at the TCP protocol level with a SYN/ACK, most UDP ports will not respond at the UDP protocol level with a simple connection request. For instance, the previous DNS query to UDP port 53 received a response because it was communicating at the levels above the protocol level such as the application level. If you were to examine the embedded payload, you would find a properly configured DNS query. The nmap UDP port scanning sends 0 bytes of payload and therefore cannot communicate above the protocol

level.

ICMP Stimulus-Response

ICMP, as you have learned, differs from TCP and UDP. Naturally, the expected set of responses differs as well. This very brief summary explains ICMP's uniqueness:

●ICMP doesn't use protocol ports to converse.

●ICMP can be a one-way transmission to inform of an error condition with no observed response.

●ICMP can be a request with an expected reply.

The error responses that might be encountered using ICMP are typically availability issues, such as if the host exists or whether access is allowed to the host. These are similar to those observed with the TCP examples. Rather than rehash more of the same, the Windows tracert command is introduced to demonstrate normal ICMP response used to discover a route from a source to destination host.

Windows tracert

The tracert command uses the ICMP echo request and ICMP echo reply pair, also known as ping, to discover the routers through which a datagram passes on its path from source to

destination host. The command output looks like this: tracert target.my.com

Tracing route to target.my.com [1.2.3.4]

over a maximum			of 30 hops:			ms	router.my.com [1.2.3.1]
1	129	ms	126	ms	130
2	229	ms	124	ms	118	ms	target.my.com [1.2.3.4]

Trace complete.

When you execute the tracert command, you see the intermediate routers through which the ICMP echo request passes. This example shows only one, router.my.com, before reaching the destination host target.my.com.

Each router and the destination host receive three separate ICMP echo requests, and tracert output displays the round-trip time for each of those datagrams to reach the router or destination host. For instance, the first three ICMP echo requests sent to router.my.com took 129, 126, and 130 milliseconds to complete the round-trip with an ICMP echo response. The multiple iterations to one router or host are done in case one or more ICMP echo requests or replies is dropped or lost because of network problems. Next, target.my.com receives three ICMP echo requests and replies with three ICMP echo replies.

TCPdump of tracert

This following TCPdump output is the result of executing the previous tracert command: tracer.net > target.my.com: icmp: echo request [ttl 1]

router.my.com > tracer.net: icmp: time exceeded in-transit tracer.net > target.my.com: icmp: echo request [ttl 1] router.my.com > tracer.net: icmp: time exceeded in-transit tracer.net > target.my.com: icmp: echo request [ttl 1] router.my.com > tracer.net: icmp: time exceeded in-transit tracer.net > target.my.com: icmp: echo request target.my.com > tracer.net: icmp: echo reply (DF) tracer.net > target.my.com: icmp: echo request