🚀 go-pugleaf

In article <47npqn$k7m@doc.armltd.co.uk> , mailto:Clive.Jones@armltd.co.uk
wrote:
> In article <U+8+qJA4e2mwEAYp@turnpike.com>,
> Richard Clayton  <richard@turnpike.com> wrote:
> >>> I know it is possible to use UDP to demon's name servers, but I was under
> >>> the impression that UDP over external links was blocked.
> >
> >A mistaken impression, otherwise traceroute would not function, let
> >alone DNS enquiries to remote name servers.
> 
> Just as a point of pedantry, I thought traceroute used ICMP not UDP.

Traceroute sends UDP packets with time-to-live values set increasingly large.
It works out where the n-th hop on the route is by looking at where the ICMP
'timed out' packets come back from.  There are some nasty ways to use ICMP
both in and out but in general most systems don't send time-out responses to
timed out ICMP packets so it is in general true that traceroute will not work
if UDP packets are rejected.  For example, our firewall rejects almost all
incoming UDP trafic so you can't traceroute to machines inside ANT Ltd. even
though you can ping them (which uses pure ICMP).

	Nicko

--
Dr. Nicko van Someren.      Vox:(44)(1223) 567808     Fax:(44)(1223) 567801
mailto:nicko@ant.co.uk                          http://www.ant.co.uk/~nicko