I have a processor (Solaris 5.8) with a router locally attached.

We're having trouble pinging the router interface from the processor with a normal ping command. The response from the router is "administratively prohibited", which normally indicates the access list on the router is bouncing the icmp request back.

However, when I issue the ping command with the '-r' parameter (ping -r x.x.x.x), the response is immediately successful. When using '-r', the TTL is limited to one, and the ping is sent to a host on an attached network. The man pages state that normal routing tables are bypassed.

With both methods, our network capture shows icmp leaving x.x.x.104 (solaris processor) destined for x.x.x.126 (router interface). I cannot see much difference besides that in the two packets, besides the TTL.

FWIW, 'netstat -nr' is showing my default gateway to be x.x.x.126.

Anyone have any ideas how I can figure out what's going on?

To me it sounds like there's some kind of rule on the router's side to discard ICMP packets with TTL different than one, presumably to avoid connection sharing. Anyway, look on the router's side for rules.