question on IP accounting

[chiehling]

My scenario: I have a Cisco 800 series at branch,a Cisco 3600 series at Headquater. Both router connect to each other using local ISP service via a Frame Relay network. Branch access to application server located at HQ,via the router, and packet will be filter off by a Firewall site at the gateway at HQ.My question is,when I perform a #sh ip account at HQ router,there are some packet source from branch router, and destination to the Firewall,instead of to my application server. I am wondering why the packets ends with destination at Firewall. Thanks.

[dgahm]

Are you using NAT on either router, or the Firewall? Of so it might explain what you are seeing.

If you are not NATing is the source address of the packets the branch router or PC addresses? A router passes packets through without altering the source and destination IP addresses, so if you are seeing the router address it would mean the router is doing something unrelated to normal application traffic. This might be NTP (time) or DHCP relay. Hard to tell without knowing the TCP or UDP ports being used.