From: John Beckett 

"Geo"  wrote in message
news::
> I don't thing that's completely true, icmp causes an arp request at the
> ethernet level so it's making a connection to the router, I don't think UDP
> does this but it's been a while since I looked at the ethernet requirements
> of the protocols so I could be wrong.

There's no difference between ICMP and UDP with respect to the need for
ARP. It's only some protocols totally unrelated to the TCP/IP family which
may not use ARP.

Perhaps you're thinking of all the ARP traffic that caused grief for many
networks that owned a fair number of IP addresses. If your company has,
say, 256 IP addresses, you will get thousands of stupid pings per day
(sometimes per hour). Each ICMP ping (if not blocked by the router) causes
the router to ARP for the internal machine that is the destination of the
random ping.

However, if the worms were sending UDP packets to random targets instead of
ICMP pings, the routers would still have sent ARP broadcasts.

John

--- BBBS/NT v4.01 Flag-5