Patent ID: 7817571

Claim:
A method, comprising: receiving an incoming probe packet via an ingress interface in a network device; de-encapsulating the incoming probe packet to provide a packet content portion and a drop result portion; testing the packet content portion against a local access control list (ACL) to determine a local drop result, wherein the local drop result includes an identification of the local ACL and a match statement from the local ACL if the testing indicates that the packet content portion would be blocked by the network device due to the match statement; updating the drop result portion in response to the testing by augmenting the drop result portion with the local drop result; determining from a routing table if there are one or more egress interfaces of the network device having corresponding output ACLs, wherein the testing and the updating are repeated for each of the output ACLs such that the testing the packet content portion comprises determining if any of a plurality of output ACLs would drop the packet content portion, and the updating comprises augmenting the drop result portion with an identification of an output ACL and a match statement therein if the output ACL would drop the packet content portion; and encapsulating an outgoing probe packet to include the packet content portion and the updated drop result portion.