Router – How to differentiate between UDP traceroute packet and the normal data traffic

Think about this very carefully.

Inside source means that you want to translate the source address from traffic originating inside your network. This is the typical "home networking" arrangement which allows you to use private addresses on the public Internet. Of course, this is not the only use for this version.

Inside destination means that you want traffic originating from an outside address to a particular destination transport protocol and port to go to a particular inside address. This is what home users do to allow something like a web server with a private address to be accessed from the public Internet. Of course, this is not the only use for this version.

Outside source translates traffic originating from outside to look like it originated from an inside address. It can useful in cases where companies with overlapping IP address ranges merge and need to start connecting the networks. You can translate the source addresses of traffic originating from the outside, which would normally have outside source addresses which conflict with inside addresses, to source addresses addresses in an available inside address range.

Outside destination doesn't really make a lot of sense since it is the inverse of port forwarding. This would limit any traffic originating from the inside, destined to a particular outside transport protocol and port, to a single outside address.

To understand the mechanism, let's see it with an example:

1. I issue a traceroute to 44.12.44.1 from my PC
2. My PC sends 3 UDP datagrams to 44.12.44.1 with TLL=1 and port=33434
3. Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=2 and port=33435
4. Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=3 and port=33436

It will keep doing that until TTL=32 and port=33465

When each one of those UDP datagrams goes through a router the TTL value is decremented and if it reaches zero, then the router returns an ICMP Time Exceeded Message, also known as ICMP Type 11.

My PC receives a lot of ICMP Time Exceeded Messages.

Checking the source IP adddresses of the ICMP message, my PC learns the IP's of the devices that are between itself and 44.12.44.1.

But it doesn't know the order. To know it, checks inside the ICMP message because it contains the header of the original UDP datagram. The UDP port minus 33434 gives the position of that device in the route to 44.12.44.1.

Keep in mind that Windows imnplementation of traceroute uses ICMP instead of UDP, that is used by Unix, Linux, BSD, etc.