What protocol is used by default when using the Traceroute tool?

By default, the Traceroute tool uses the ICMP (Internet Control Message Protocol) protocol to send echo requests (ping) or UDP packets with increasing TTL (Time To Live).

Behavior may vary across different operating systems:

• In Windows, Traceroute (tracert) typically uses ICMP Echo Request.
• In Unix-like systems (Linux, macOS), traceroute more often uses UDP packets with a high port number.

The main idea is to send packets with gradually increasing TTL, so each intermediate router sends back a message about the time expiration, allowing to determine the route to the final node.