On (2013-07-02 21:00 +0000), Jeffrey G. Fitzwater wrote: > I have 0.0.0.0 pointing to one of our ISP so that any prefix < /24 ( which we > don't permit in from any ISP) would get pushed to that ISP which might have > route. > > I am just trying to figure out how may are being pushed to default.
You'd need to analyse your copy of FIB offline, it wouldn't be too hard, but I'm dubious of its benefits. Maybe more useful would be to see what traffic actually hits it, you could do this via evil hack. Loop two cables together: Int gigaloop1 ip address 10.10.10.0 255.255.255.254 int gigaloop2 ip vrf forwarding HACK ip address 10.10.10.1 255.255.255.254 int Internets ip address 192.0.2.1 255.255.255.0 ! ip route 0.0.0.0 0.0.0.0 gigaloop1 10.10.10.1 ip route vrf HACK 0.0.0.0 0.0.0.0 Internets 192.0.2.2 ! monitor session 1 source interface gigaloop1 monitor session 1 destination interface gigaspan Now you'd have port-monitor for traffic hitting default route :) (Extra points for doing this by poking in TCAM new LTL index for the 0.0.0.0 adjacency index) -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
