Vince Fuller wrote:

You'll also need to pursuade your router vendor to violate the ICMP spec, which says that ICMP error messages (i.e. TTL exceeded) are never sent in response to ICMP messages...

I suspect that this restriction is precisely the reason that "traceroute" uses high-port UDP packets.

That is correct. (There are other reasons, too). However, sending ICMP errors in response on ICMP ECHO Request is safe. Unlike sending random UDP messages to random ports. Maybe ICMP specs should be updated and this is the rare case when Microsoft got it right (in spirit, if not letter). --vadim