They can use the port-less ICMP
Would you care to explain this, or maybe direct me towards a URL.