We have few access-list and all showing counter for hit but one access list not showing anything.

C3850#show access-lists 101
Extended IP access list 101
    5 permit ip any (7 matches)
    10 deny ip any any fragments
    20 permit ip any any (202593 matches)

Any idea why 10 deny ip any any fragments has no counter on it? I tried to send big packet and it dropped but no counter.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 22:58

1 Answer 1


(This came up on DSLR recently.)

It has to do with the way traffic is processed. Since the first fragment carries the full layer-4 information, it is not handled as a fragment. So, it will match rule 20, and a NAT/CEF/flow entry will be created for it and all subsequent fragments will not go through the ACL -- it's part of an established flow that's already been checked. Unless you turn off "route-cache" -- thus making all packets process switched (very, very bad idea) -- every individual packet is not passed through the ACL.

  • @Satish, fragments are built into the DNA of IP from the very start. Just because yout network gets fragments from the outside, doesn't mean anything is wrong, or that anybody is throwing bad stuff at you. RFC 791, INTERNET PROTOCOL, the very definition of IP, Section 1.4. Operation, the very first sentence reads, "The internet protocol implements two basic functions: addressing and fragmentation."
    – Ron Maupin
    May 31, 2016 at 21:48
  • 1
    @RonMaupin, just because fragments have always been part of IP doesn't make fragmentation normal... there are some evil IP fragmentation hack attacks that you used to be able to send to a machine that would completely lock it up (ref the "nestea attack" for linux, or the "teardrop attack" for windows). To wit, Cisco refuses to burn fragmentation into ASICs because there are so many nasty corner cases to handle and they're afraid they will burn in a security vulnerability... it's much easy to patch IOS than send someone a new router to rack May 31, 2016 at 22:12
  • 1
    On the modern internet, you should not be seeing fragments. I use ip virtual-reassembly drop-fragments on all internet facing interfaces. If you cannot talk to me without spewing fragments, then I don't need to talk to you. :-)
    – Ricky
    May 31, 2016 at 22:53
  • is there any impact using ip virtual-reassembly drop-fragments command? How does it work and drop fragment packet?
    – Satish
    Jun 1, 2016 at 19:43
  • I meant, is it safe to use because it will stop all fragment traffic regardless TCP or UDP.. we are getting NTP, DNS, Chargen IP frag attack most of time.
    – Satish
    Jun 1, 2016 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.