To defend against network mapping, which of the following packets should be denied at the border router?

UDP-based traceroute (the default on Unix/Linux systems) works by sending UDP datagrams to high-numbered closed ports with incrementing TTL values. When those datagrams reach the destination host, the host responds with ICMP Port Unreachable messages to signal arrival. Dropping outgoing ICMP Port Unreachable messages at the border router removes this final acknowledgment, preventing attackers from determining which hosts are reachable and completing their network topology map.

Blocking outgoing ICMP Echo Requests restricts your own hosts from pinging external targets, which has no effect on an external attacker actively mapping your network.

Incoming ICMP Time Exceeded messages are generated by intermediate routers when TTL expires in transit - blocking them would only break your own outbound traceroute, not prevent external parties from mapping your infrastructure.

Blocking incoming ICMP Echo Requests stops ping sweeps but does not prevent UDP or TCP-based traceroute, port scanning, or other techniques attackers use for network mapping.