1

I want to prevent all hosts from seeing the core router when they do traceroute , knowing that I'm using cisco router , any idea to do this ?

  • 1
    You could try filtering ICMP Time Exceeded messages from that source. How do they know it's a Cisco router? They shouldn't be able to see anything but the MAC which can be changed. – Zac67 Aug 6 '17 at 11:19
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 3:01
1

you can create an ACL in order to deny icmp time-exceeded (deny icmp any any time-exceeded), and apply it on the interfaces.

EDIT : to understand why you should block time-exceeded you can enjoy reading this very detailed post

http://www.slashroot.in/how-does-traceroute-work-and-examples-using-traceroute-command

1

Yeah, to hide Cisco router itself from traceroute output, create extended ACL that denies time-exceeded ICMP requests.

(config)# ip access-list extended 111
(config-ext-nacl)# deny icmp any host <IP_OF_ROUTER> time-exceeded log
(config-ext-nacl)# permit any any
(config-ext-nacl)# exit
(config)# interface <NAME>
(config-if)# ip access-group 111 in

Described config hides only this particular router's IP address from traceroute answer (asterisks instead), all the next hops still appears. To prevent that also, change 2nd line to:

(config-ext-nacl)# deny icmp any any time-exceeded log

Then traceroute from host machines will not be able to complete, output will show lots of asterisked lines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.