deny a big ping

[amenash123]

hi

how can i deny a big from the world to my router,i want that small ping like for exemple 32 byte will be avalible , but big ping will be deny.

thanks

[Mikhail.Galiulin]

Hi,

I think you should check policy-based routing.

There are some possibilities to match packets after its size (match length _min _max). I never used this feature myself but on paper it looks promising... :-)

Check this document for example

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800c75d2.html

//Mikhail Galiulin

[amenash123]

i don't want to deny addresses i wany to deny a big ping to my interface.

[Mikhail.Galiulin]

This is exactly what I recommend:

use MATCH LENGTH command in route map

//Mikhail Galiulin

[amenash123]

i understand you

but what if want to move a big packet like 1400

and ping i want to move maximum 32?

[Mikhail.Galiulin]

I guess you need to combine two "match" statements in the same route map - one will be based on extended access-list and choose only ping trafic and another one will check the packet size.

//Mikhail Galiulin

[amenash123]

i try that and it's not success

[Mikhail.Galiulin]

Hi,

Here is the solution that works (just tried it in my lab on 2 17XX routers):

!

class-map match-all large_ping

match packet length min 1000

match protocol icmp

!

policy-map tst

class large_ping

drop

!

interface FastEthernet0

ip address 192.168.112.252 255.255.255.0

service-policy input tst

Here is the result:

EMBOR1FRA#ping 192.168.112.252 size 1000

Type escape sequence to abort.

Sending 5, 1000-byte ICMP Echos to 192.168.112.252, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

EMBOR1VPNA#ping 192.168.112.252 size 999

Type escape sequence to abort.

Sending 5, 999-byte ICMP Echos to 192.168.112.252, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms

EMBOR1VPNA#

//Mikhail Galiulin