Why is my trace route (mtr) binding a UDP port when it runs?

Question

I occasionally audit the open ports on my machine to make sure I fully understand my attack surface. When I did this today, I discovered that mtr was listening on a high UDP port (which seemed to change each time I ran). Does anyone know why this is the case? I had a brief look at the manual and did some googling but I couldn't find a discussion of this

Steps to reproduce:

run mtr 8.8.8.8 in one window, run in another sudo lsof -i udp | grep mtr

UPDATE:

To clarify what I mean my listening UDP port the output from lsof looks like this

mtr 31791 user 8u IPv4 221685 0t0 UDP *:39850

Answer 1

Short answer: that's how traceroute works.

Long answer: a traceroute is conducted by sending out UDP packets (by default on most traceroute programs, can usually be modified on the command line to use TCP or ICMP) with an initial TTL of 1, and them monotonically increasing TTL values. This enables the original sender to get the "packet times out message" from each subsequent router as the TTLs expire along the way, culminating (hopefully) in a return that says "packet made it safe and sound!". The original sender (mtr in this case) simply listens for those packet expiration messages and prints the information for each place the trace died due to TTL expiration.