Hi, yes, indeed UDP was the cause. Solved now. Thx.
My motivation was to eliminate outgoing UDP traffic completely as we don’t use such services in our LAN. But of course traceroute diagnosis is an exception.
I must admit, I never would have expected that traceroute uses UDP, I rather was thinking it uses an L2 protocol (hmm. of course L2 protocol works only in LAN, so let’s forget that remark 
)
Nevertheless I’ll change that rule so that only admins can use UDP, but not the normal users. This should be possible with station IPs.
Update: found even a much better solution. “man traceroute” says:
lft , the Layer Four Traceroute, performs a TCP traceroute, like traceroute -T , but attempts to provide compatibility with the original such implementation, also called
“lft”.
That “lft” seems to work with TCP instead of UDP, so then I can block the UDP again.
The MikroTik traceroute tool is good too, but of course it can work only on the router/switch device. We need a more flexible method, ie. from any PC station (all Linux here). The above said Linux tool “lft” is ok. Already reverted back and tested with lft: works like a charm.