Topic 'Re: [Patriot] tracert broken?' in forum 'RCN' - dslreports.com http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8767207 en Fri, 25 Mar 2022 16:16:03 EDT Fri, 25 Mar 2022 16:16:03 EDT Re: [Patriot] tracert broken? http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8800966 http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8800966 Tue, 16 Dec 2003 07:32:26 EDT Re: [Patriot] tracert broken? http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8799607 

The Nachi worm detects the availability of a node by
sending ICMP type 8 (echo request) packets before trying
to exploit the RPC vulnerability. The size of the ICMP
packet is 92 bytes including the IP header. 
 
The following Policy Based Routing (PBR) configuration can
be used to match and drop the ICMP type 8 and type 
packets that are 92 bytes long. 
 
The ICMP type 8 packets generated by the ping utility on
other operating systems such as Cisco IOS, Windows 2000,
Linux and Solaris, have different packet sizes than 92
bytes. This configuration should not filter the packets
that are generated by the ping utility on those operating
systems
Warning: Microsoft Windows tracert utility uses 92 bytes
sized ICMP packets. Using PBR to filter those packets will
cause tracert utility not to work.

Such a restriction in your aread are likely necessary at the current time in order to prevent Nachi from spreading further. You should still be able to run traceroute if you run Linux or a non MS windows OS.

Or you can download a third party traceroute utility which has a configurable packet size, or one that simply doesn't use 92 byte icmp packets. It appears that the freeware version of ping plotter available at »www.pingplotter.com/down ··· lt_1.exe might meet your needs. ]]> http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8799607 Tue, 16 Dec 2003 00:33:25 EDT Re: [Patriot] tracert broken? http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8793263 http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8793263 Mon, 15 Dec 2003 14:04:33 EDT Re: [Patriot] tracert broken? http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8792364

Hello,
This is normal...tracert is disabled for network safety
Thanks
Patriot Support
]]> http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8792364 Mon, 15 Dec 2003 12:21:24 EDT Re: [Patriot] tracert broken? http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8778266
Called Patmedia, (hold time 10m32s after prompts- I thought these were supposed to be faster now) The rep said it sounds like "a software issue" and was about to dump the call so I quickly explained that 1) Tracert is a network troubleshooting tool that I use to avoid calling them when I can determine network problems I see are not THEIR fault and 2) Tracert is a tool that is probably older than she was, so I sincerely doubt it was the problem.

I got put on hold and eventually transferred to either tier2 or network support, who ask a little history, said it was odd, I mentioned that you had the same problem in Neshanic Station (so hopefully they look at that too), he did confirm that others using patmedia CAN tracert so it wasn't a global problem, and that Neshanic Sta. and Harding (my loc) are on different UBRs so it wasn't confined to just my area. He thinks it may be possible that tracert might be accidentally cut off for us and said he has opened a ticket to have them take a look.

Like ping, tracert isn't something I use a lot, but when I use it, I expect it to work.]]> http://www.dslreports.com/forum/Re-Patriot-tracert-broken-8778266 Sat, 13 Dec 2003 20:46:14 EDT [Patriot] tracert broken? http://www.dslreports.com/forum/Patriot-tracert-broken-8767207 http://www.dslreports.com/forum/Patriot-tracert-broken-8767207 Fri, 12 Dec 2003 16:27:53 EDT