0

I have found serveral examples where the last tracert hop is shown twice but not exactly an outlput like I've got here: The network setup look like that: enter image description here

Between the two sophos UTM firewalls 77.77.77.77 and 88.88.88.88 there is a site-to-site tunnel that routes the two networks 192.168.222.0/24 and 192.168.111.0/24 through the tunnel. Everything works fine but the weird tracrt output insecures me a little. The tracrt command
tracrt XXX.domain.local
is executed from the laptop 192.168.222.13.
Outputis the following:

enter image description here

Thanks in advance for your opinion!

1

Seems normal to me.

  • First hop: left site Sophos router
  • second hop : right site Sophos router
  • Third hop : should be 10.1.1.2 , I.E layer 3 switch interface connected to the Sophos device, but it seems it is configured to not respond to traceroute coming on this interface
  • fourth hop : target computer

Routers respond to traceroute (by default) with the IP address of the interface on which the trace is received.

So 192.168.111.220 is likely the IP address of the tunnel interface of the Sophos device on the right site.

  • Hi, thanks for your response. The second line of the output shows 192.168.111.220 which is the final destination. That is confusing for me. The rest seems plausible the layer3 switch won't respond to traceroute. – Totze1982 Jan 10 at 9:10
  • @Totze1982 see my edit. – JFL Jan 10 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.