interesting traceroute I am getting thru a firewall where we are NAT'ing both Source and Destination. I am wondering if it is possible to get this to work. We are trying to set up a traceroute monitor to trace routes out on the far end of our firewall. We are using Nagios to report back if the last hop changes to gives us an idea of any fluctuations. I have the Nagios script working internally, however when I cross to a Host on the far end of the Firewall. I am receiving werid info back from the trace route command. I've tried both ICMP and TCP traceroutes.

Here is what I am getting.

traceroute to (, 30 hops max, 60 byte packets
 1  0.532 ms  0.753 ms  0.619 ms
 2  1.844 ms  1.994 ms  2.048 ms
 3  1.993 ms  1.988 ms  1.968 ms
 4  2.167 ms  2.178 ms  2.172 ms
 5  2.754 ms  2.257 ms  2.761 ms
 6  2.460 ms  2.749 ms  2.839 ms
 7  3.105 ms  2.923 ms  2.979 ms
 8  3.420 ms  3.508 ms  3.398 ms
 9  3.092 ms  2.997 ms  2.936 ms
  • This is a linux box with IP of, which we Source NAT to when traversing
  • The is the NAT of the Host on the far end of the Firewall, the translation to it's real is
  • The Firewall is a Palo Alto running code v6.1
  • The firewall will not generate an ICMP error. You should be able to configure that.
    – Ron Maupin
    Oct 25, 2016 at 3:30
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7, 2017 at 20:13

1 Answer 1


I would guess that the NAT is deliberately changing the source IP for ICMP errors coming from the network behind the NAT to reduce the chance of them being dropped by ingress filtering.

I do not know the specifics of the NAT device you are using and hence I do not know if this behaviour is configurable.

  • Pretty sure this is what is happening. Oct 25, 2016 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.