| This statement tells your router not to answer the traceroute with the standard time exceeded messages: access-list 101 deny ICMP any any The above command will deny traceroute for any address, both incoming and outgoing from the network. If, however, traceroute is a necessary tool for certain networks, then you can create an access control statement to permit traceroute for that network address. For example, to permit network 192.168.15.0 to do a traceroute, type: access-list 101 permit ICMP 192.168.15.0 0.0.0.255 any