A city clerk's office ACL that should block inbound Internet probes never matches interesting traffic. Engineers confirm the entries are correct. What common application mistake explains the miss?

When a city clerk's office ACL that should block inbound Internet probes never matches interesting traffic despite correct entries, the common application mistake is applying the ACL in the wrong direction on the interface relative to the traffic flow being filtered. ACL direction is relative to the router interface: inbound inspects packets entering that interface, outbound inspects packets leaving it. A perfect deny list facing the wrong way simply never sees the probe traffic, so hit counts stay flat and probes succeed. Claiming the ACL number was even instead of odd and thus silently ignored fails because IOS does not discard ACLs based on even/odd numbering superstition. Asserting named ACLs cannot filter IPv4 until NetFlow sampling is 1:1 fails conceptually: ACL filtering is independent of NetFlow sampling rates. Stating standard ACLs only work on loopback0 regardless of traffic direction fails because standard ACLs can be applied on appropriate interfaces/directions for source filtering and are not restricted to loopback0. Exam caveat: "inbound" relative to the civic network perimeter is not always the same as "in" on every interface—draw the packet path before choosing direction. Operational check: diagram where probes enter the router, confirm ip access-group direction on that interface, clear counters, regenerate probes, and confirm the intended ACEs increment; if not, reverse direction or move the ACL to the interface that actually receives the flow.