I have a router interface configured with the following access list:
access-list 101 permit tcp any any eq 23
access-list 101 deny ip any any
effectively, telnet is allowed and all other protocols are denied. when I start a debug on this access-list (debug ip packet list 101 detailed) and start telnetting to the router, everything works (as it should). But when I look with "show ip access list" I see there are about 30 matches on the "...eq 23" rule, which is correct, but there are also around 30 matches on the deny ip any any rule. The debug output shows only port 23 traffic and return traffic.
My question: what packets hit the "deny ip any any" rule when starting a telnet session?
