From: John Beckett 

"Geo"  wrote in message
news::
> I didn't know that (udp/icmp) but that could possibly account for some of
> the speed difference since udp is connectionless.

Yes, UDP is connectionless. But that comparison only applies in regard to
TCP. We don't normally say that ICMP is connectionless because the purpose
of ICMP is to pass a short pre-defined message, not to pass arbitrary data
(although some hackers are using it for that now!). However, ICMP is
connectionless.

The UDP and the ICMP traceroute are pretty-well identical. Each sends a
single packet with TTL = n (n = 1, 2, 3...), then waits for a reply.

I haven't seen an authoritative reason why Microsoft chose ICMP, but I did
see a suggestion that ICMP should pass through more firewalls (whereas any
self-respecting firewall should block the UDP packets to the weird port
numbers that traceroute uses).

John

--- BBBS/NT v4.01 Flag-5