Port 33434 traceroute · UDP

What runs on port 33434

The base UDP port of traceroute: Unix traceroute sends probes to 33434 and increments per hop (33434–33534), expecting ICMP "port unreachable" from the destination because nothing listens there. A firewall that blocks this range inbound makes traceroute end in asterisks at your host, even though the host is up. Windows tracert uses ICMP echo instead; mtr and traceroute -I/-T use ICMP or TCP.

Software that uses it: traceroute · mtr · tcptraceroute · network diagnostics in monitoring tools

Should port 33434 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Allow UDP 33434–33534 inbound (or let the ICMP unreachable out) if you want traceroutes to your servers to complete.
• traceroute -T -p 443 host traces with TCP SYNs, which pass firewalls that block UDP probes.

Check port 33434

# on the host: is anything listening, and which process?
ss -lunp 'sport = :33434'
sudo lsof -i :33434

# from another machine: is it reachable?
nc -zuv host 33434
sudo nmap -sU -p 33434 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 33434

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 33434 proto udp
sudo ufw deny 33434/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 33434 accept
nft add rule inet filter input udp dport 33434 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 33434 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 33434 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=33434 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 33434" with no source is just "open".

Related ports

• 53 DNS — Domain name resolution; TCP for large answers and zone transfers
• 123 NTP — Time synchronisation

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions