What port does traceroute use?

This question rewards candidates who understand how traceroute works rather than those who memorise a port number. The premise — that there is one "traceroute port" — is the trap.

Why there is no single port

Traceroute is a technique, not a single fixed protocol exchange. The original Van Jacobson Unix tool sends UDP datagrams to a deliberately unlikely high destination port, starting around 33434 and incrementing per probe. Microsoft's tracert, by contrast, sends ICMP Echo Requests — and ICMP has no ports at all, since ports are a Layer-4 concept and ICMP lives at Layer 3. Many modern tools can also use TCP SYN to a chosen port (often 80 or 443) to slip past firewalls. So the honest answer is "it depends on the implementation."

The TTL mechanism is the real trick

The clever part has nothing to do with the destination port. Traceroute sends packets with TTL = 1, then 2, then 3, and so on. Each router that decrements the TTL to zero discards the packet and returns an ICMP Time Exceeded message (type 11). By collecting the source addresses of those replies, traceroute reconstructs the path hop by hop. The final hop is identified when the probe actually reaches the destination — a UDP probe to a closed high port elicits an ICMP Port Unreachable (type 3, code 3), which signals "we've arrived."

Why the distractors are seductive

The fake "TCP port 33434" answer borrows the real Unix base port number but pins it to the wrong protocol. "ICMP port 30" invents a port for a protocol that has none. "UDP port 53" plays on the real firewall-evasion idea but misattributes it to DNS.

What interviewers want

A confident "there's no fixed port" plus the TTL-and-Time-Exceeded explanation, and ideally the note that Windows and Unix differ. That demonstrates you understand the mechanism, not just a trivia number.