After filtering 92byte ping packet, can't traceroute...T.T

zesum · ‎09-25-2003

hi.

After deny 92byte ping packet,

We can't traceroute...

help me..T.T

internet -- 7513 -- 6509MSFC2--- Cat3500XL

[1] Cisco 7513router(rsp-jsv-mz.121-20.bin)

int s1/1/1

ip policy route-map welchia

int gi3/0/0

ip policy route-map welchia

ip access-list extended ping

permit icmp any any echo

permit icmp any any echo-reply

route-map welchia permit 10

match ip address ping

match length 92 92

set interface Null0

[2] MSFC2(c6msfc2-psv-mz.121-8a.E3)

int vlan 10

ip policy route-map welchia

int vlan 20

ip policy route-map welchia

...

ip access-list extended ping

permit icmp any any echo

permit icmp any any echo-reply

route-map welchia permit 10

match ip address ping

match length 92 92

set interface Null0

jamey · ‎09-25-2003

Are you doing traceroutes from a Windows machine? Windows machines use 92 byte traceroute probes.

zesum · ‎09-25-2003

thanks.

Have a good day~!

jamey · ‎09-25-2003

Are you doing traceroutes from a Windows machine? Windows machines use 92 byte traceroute probes.

fabbasi · ‎09-30-2003

Microsoft Windows tracert utility uses 92 bytes sized ICMP packets, so won't work if you are blocking this packet size.

Check out Cisco Security Notice documnet ID 44665 for more details.