The original tracert program used to send packets to a random UDP port while varying the TTL. This worked as long as the receiver did not actually use this port - if it did, random things could hapen. Later versions of tracert send IPMP echo requests to the target host, which was a bit safer. But then came pings of death attacks, and many administrators would close ICMP off.
But the attack documented here is interesting in that it is effectively a tracert 'inside' an otherwise legitimate session. Using this approach, just about every stateful firewall and NAT devlce in existance would allow/pass the packet (since in theory the packet is valid within the session). Most sensible firewall administrators might close off traditional tracer-ing, but would be pretty powerless to stop this sort, assuming they even noticed it in the first place!
This is an entire new class of espionage tools for internal espionage. An employee could run a tool build to do this and pretty much blueprint the entire network in a matter of a few minutes. This is also open to attach from an "