I occasionally audit the open ports on my machine to make sure I fully understand my attack surface. When I did this today, I discovered that mtr was listening on a high UDP port (which seemed to change each time I ran). Does anyone know why this is the case? I had a brief look at the manual and did some googling but I couldn't find a discussion of this

Steps to reproduce:

run mtr in one window, run in another sudo lsof -i udp | grep mtr


To clarify what I mean my listening UDP port the output from lsof looks like this

mtr 31791 user 8u IPv4 221685 0t0 UDP *:39850

1 Answer 1


Short answer: that's how traceroute works.

Long answer: a traceroute is conducted by sending out UDP packets (by default on most traceroute programs, can usually be modified on the command line to use TCP or ICMP) with an initial TTL of 1, and them monotonically increasing TTL values. This enables the original sender to get the "packet times out message" from each subsequent router as the TTLs expire along the way, culminating (hopefully) in a return that says "packet made it safe and sound!". The original sender (mtr in this case) simply listens for those packet expiration messages and prints the information for each place the trace died due to TTL expiration.

  • Hmm, so using a tcdump 'host' -nl -i any it looks like mtr is using ICMP by default. This UDP port seems to still be bound regardless of whether --udp or --tcp is used. A tcpdump seems to show that the bound port is different for the ephemeral port used to send packets from with mtr --udp.
    – Att Righ
    May 5, 2017 at 20:57
  • @AttRigh Indeed, tcpdump defaults to UDP and mtr to ICMP. May 6, 2017 at 7:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .