I wrote the original tcptraceroute in 2001. The article mentions many traceroute implementations change the source port to associate queries with responses.

I wrote the original tcptraceroute in 2001. The article mentions many traceroute implementations change the source port to associate queries with responses. Another technique is to use the IP ID field, leaving the source port static. In tcptraceroute, you can choose either method using "--track-id" or "--track-port". By comparing the two, you can sometimes see traffic being load-balanced across multiple links. I just did a quick write up of this at https://gist.github.com/mct/2ae1dbc2d596f59f5aff https://gist.github.com/mct/2ae1dbc2d596f59f5aff (which I should add to the examples.txt file)