strange thing in traceroute, last hop is my own ip-address

Apr 08, 2006 1 Replies
strange thing in traceroute, last hop is my own ip-address open original image

Hi!



I found a strange thing with a traceroute. When I do a traceroute from a Cisco router to a Nortel-device (I do not know which exactly) the last hop (which is the Nortel-device) does not show its ip-address, instead it show the source-address of the device I was tracing from. If I try it with different source-addresses, I always see my own source-address as the last hop. This only happens with this one special device. If I do a traceroute to another device in the same net, I see the device's ip-address as the last hop. Does Nortel use a "trick" to manipulate the ip-address in the traceroute? Is it a simple security feature (you do not see me in the traceroute).



Thanks. Frank


It is possible that the Nortel device is manipulating the source IP address of the ICMP time-exceeded message that it sends back. If you don't expect lots of ICMP traffic to the box, you should be able to turn on "debug ip icmp" on the Cisco box safely and look at the output to see what the Nortel box is sending back to you in response to the traceroute probe and figure out if they are indeed using a bogus source IP address.

Cisco da Gama

formatting link

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required