Re: ACL for traceroute

From: Petr Lapukhov (petr@internetworkexpert.com)
Date: Mon Jul 03 2006 - 11:48:34 ART


Ken,

you should undestand how "Unix" and "Windows" traceroute
variants differ, and recall one special RFC ;)

1) Unix variant sends udp probes, and expects either "ttl-exceeded"
or "port-unreachable" icmp responses.

2) Windows variant sends icmp "echo" message, and awaits for
"ttl-exceeded" or "echo-reply". This is actually a bit of RFC
non-conformant,
since icmp messages should not be sent in response to problems
with icmp messages ;) But who cares ;)

Now, what is "icmp traceroute" message? Check out

http://www.networksorcery.com/enp/RFC/rfc1393.txt

for an "advanced traceroute" proposition. I actually didn't see any
implementation of it. But it utilizes special icmp message to quickly
probe packets path. Since we basically use icmp or udp traceroute,
you dont need to care for that icmp code :)

HTH

-- 
Petr Lapukhov, CCIE #16379
petr@internetworkexpert.com

Internetwork Expert, Inc. http://www.InternetworkExpert.com Toll Free: 877-224-8987 Outside US: 775-826-4344

2006/7/3, Ken <hpnkpn103@yahoo.co.jp>: > > Hi, > > Is there a difference between the statement > > permit icmp any any ttl-exceed > permit icmp any any unreachable > > and the statement > > permit icmp any any traceroute. > > Thank you! > > _______________________________________________________________________ > Subscription information may be found at: > http://www.groupstudy.com/list/CCIELab.html



This archive was generated by hypermail 2.1.4 : Tue Aug 01 2006 - 07:13:46 ART