not rewriting next-hop, pointing default, ...

Fri Sep 12 10:02:27 UTC 1997

> > In a world where SSH were available in cisco routers and/or
> > IPsec were more widely deployed, I might have different views.

Failing this, the ability to disable responding to packets (*)
with source route set on the Cisco *host* TCP/IP stack
(and continue to forward them), would allow it to be
easilly enabled in your core, and filtered at borders
with machines and vulnerable equipment attached. IE
you filter out such packets as part of your normal firewalling.
This would prevent the telnet to Cisco with LSR poblem.
Thus traceroute -g would give you the useful information,
then star out if you were tracing to (say) www.uu.net.

(*) - urm, except responding to traceroutes etc. :-)

Alex Bligh
Xara Networks