«

Hi!

I found a strange thing with a traceroute.
When I do a traceroute from a Cisco router to a Nortel-device (I do not know
which exactly)
the last hop (which is the Nortel-device) does not show its ip-address,
instead it show the source-address
of the device I was tracing from. If I try it with different
source-addresses, I always see my own source-address
as the last hop. This only happens with this one special device. If I do a
traceroute to another device in the same net,
I see the device's ip-address as the last hop.
Does Nortel use a "trick" to manipulate the ip-address in the traceroute?
Is it a simple security feature (you do not see me in the traceroute).

Thanks.
Frank

It is possible that the Nortel device is manipulating the source IP
address of the ICMP time-exceeded message that it sends back. If you
don't expect lots of ICMP traffic to the box, you should be able to
turn on "debug ip icmp" on the Cisco box safely and look at the output
to see what the Nortel box is sending back to you in response to the
traceroute probe and figure out if they are indeed using a bogus source
IP address.

Cisco da Gama
http://ciscostudy.blogspot.com