MTU oddities...

Thanks for the very nice problem description and data. Perfect.

Here is a bit of a guess.

The small packets pass OK - follow so far:-)

The big ones are correctly being rejected by /your PC/ and you are being informed.

The middle ones being rejected by the router but it is not telling you.

I presume that you do not have "no ip unreachable" configured on the internal interface? ' cos that would do it.

Maybe you have an access-list blocking them?

Run tcpdump/ethereal on the linux box and see who exactly is sending the unreachables. I don't know if when you send unreachables to yourself if the capture tool will see them. On Windows with Ethereal it doesn't see either the outbound or the inbound from itself.

It is possible on the cisco to see the packets but it is a bit of a palaver.

deb ip packet [det]

BUT

you need to turn off fast switching first.

int x no ip route-cache

int y ..... same....

then you need to send the debug output where you want.

logg buffered deb ! RAM buffer logg buff 50000

logg monitor deb ! telnet session logg console deb ! serial console - risk of high CPU

THEN

to get the telnet one to work you need to issue

terminal monitor ! term no mon - not no term mon?

Finally, you get to see a brief description of the packets.

You can also add an access-list to it deb ip pac 100

Also access-lists can be used for tracking packets.

ip access-l ........ log

or even just sh ip access-l ! display a count of matches.

Post the config if you like.

OK, I guess you found the culprit (didn't test it yet), I have indeed "no ip unreachables" on FastEthernet0... It seems it is a default config of SDM when you run a security audit...

In fact I didn't even think my _pc_ was sending me the icmp message, I was under the impression the router did. But in fact you are totally right, and that further explain why it says MTU=1500 in the icmp message since my pc is connected to Ethernet...

Oh well, I should have tried harder ;-)

Many thanks for the debug info. I tried earlier debug ip packet, but nothing was printed. I think this is because I was running cef.

Regards,

-- Brice

You need to do all of the steps above to get debug output.

ip cef ! is OK ot global config level

but on each interface you need

no ip route-cache

You may need

ip route-cache cef

to get back where you started.

If you are not getting debugging output post the steps you have taken and the first page of a sh log. State where you are looking for the output. It does work.

Remember to turn "ip route-cache" back on after you have gotten this to work. That statement makes all packets process switched (which is necessary to see packets with "debug ip packet") and can put a real hurt'n on your throughput.

Scott