I want to prevent all hosts from seeing the core router when they do traceroute , knowing that I'm using cisco router , any idea to do this ?
you can create an ACL in order to deny icmp time-exceeded (deny icmp any any time-exceeded), and apply it on the interfaces.
EDIT : to understand why you should block time-exceeded you can enjoy reading this very detailed post
Yeah, to hide Cisco router itself from traceroute output, create extended ACL that denies time-exceeded ICMP requests.
(config)# ip access-list extended 111 (config-ext-nacl)# deny icmp any host <IP_OF_ROUTER> time-exceeded log (config-ext-nacl)# permit any any (config-ext-nacl)# exit (config)# interface <NAME> (config-if)# ip access-group 111 in
Described config hides only this particular router's IP address from traceroute answer (asterisks instead), all the next hops still appears. To prevent that also, change 2nd line to:
(config-ext-nacl)# deny icmp any any time-exceeded log
Then traceroute from host machines will not be able to complete, output will show lots of asterisked lines.