All UDP information (including the port number) is encrypted:
(Please note that the link above points to the specification of ESP as it was when Steven Bellovin published his USENIX paper. This RFC is now obsolete.)
Guessing the port number should be quite easy: use the
netstat command to list UDP ports in use, ignore the ones with a peer address which does not match, and the ones used by known services.
Actually the answer could be found in the original paper a few lines bellow where the TCP case is discussed.
Still, on modern high speed net works it isn't that hard to make the
sequence numbers wrap, and the attacker may be able to learn the
necessary port numbers by polling via netstat on either machine.
This is very simple: the attack does not require much sophistication on the attacker's part. All that is required is a network capture and basic knowledge of UNIX system utilities such as
This is Bellovin's point here: in this case tampering of the transmitted data is not even necessary to mount an attack. This is why waiting for the end of the process is mentioned. The attacks which can be performed while the process is still running require more work or more specialized tools. (Bellovin's main attack involves tampering with unauthenticated CBC encrypted data, as pointed out by Poncho in a comment.)