10

I ran the following traceroute once, while trying to disagnose a network problem.

c:\>tracert linode.com -d

Tracing route to linode.com [67.18.186.61]
over a maximum of 30 hops:

  1    <1 ms     *       <1 ms  10.43.51.252
  2     1 ms    <1 ms    <1 ms  10.45.253.33
  3    <1 ms    <1 ms    <1 ms  10.62.254.251
  4    20 ms    23 ms    45 ms  192.118.32.52
  5    47 ms    20 ms    85 ms  207.232.60.250
  6    54 ms    24 ms    79 ms  212.143.8.69
  7     7 ms    79 ms    11 ms  212.143.8.209
  8    89 ms   110 ms   108 ms  212.143.12.75
  9   143 ms   240 ms    94 ms  212.143.14.154
 10   244 ms   179 ms    95 ms  10.50.1.1
 11   176 ms    80 ms   190 ms  195.66.225.105
 12   174 ms   164 ms   157 ms  70.87.255.217
 13   187 ms   185 ms   186 ms  70.87.253.189
 14   189 ms   194 ms   195 ms  70.87.253.18
 15   187 ms   188 ms   190 ms  70.87.253.126
 16   187 ms   185 ms   185 ms  70.87.254.78
 17   186 ms   184 ms   187 ms  67.18.186.61

Trace complete.

The first three sites are local routers / gateways; ignore those.

I'm not sure, however, how step 10 could give me 10.50.1.1 as a target? Isn't that an unroutable IP that shouldn't be anywhere to be found from a public router?

5 Answers 5

11

RFC1918 addresses (10/8, 172.16/12 and 192.168/16) should not appear in global routing tables, as they're designed to be used within "a single enterprise". However, it makes sense, to some extent, using RFC1918 addresses for your point-to-point links within your core, even if the traffic going across those links are for "globally routable" IP address ranges, as this conserves a slightly scarce resource.

The reason it shows up in the traceroute is that the TTL of an IP frame expired on an interface with that as its interface IP. The down-side of doing this is that it gets harder to ping the interface and do some troubleshooting on the issue, but there is no guarantee that you should be able to do that anyway.

So, I'd say that it may be a bit unusual, but it's certainly not unheard of.

1
  • I have used a prefix from private address space "temporarily" (for a few months) for an asymmetric route. The clients were puzzled because with traceroute from they computers to internet they were seeing the private IP, but from internet to their IP, the private IP was not showing. Apr 9, 2010 at 19:26
5

That does seem odd to me. It is perfectly okay too see private IPs in the middle of a route, because a single organization can use a private IP within their network. But according to whois, 212.143.14.154 and 195.66.225.105 are owned by two different organizations. But maybe these two orginizations have a point to point between each other, in which case the could use a private IP for it.

The term non routable is not entirely accurate, because they can be routed. However, the should only be used by a single 'enterprise', the term RFC1918 uses. Which is why I find this a bit odd.

2
  • 2
    Of course, whois is not really that reliable Aug 27, 2009 at 12:58
  • they could have a PTP link, but since one is an Israeli ISP [corporate connection, in this case] and one is a major US hosting provider [theplanet.com], it seems kind of strange.
    – Mikeage
    Aug 28, 2009 at 5:27
3

I saw it happening on some juniper routers. They had proper public ip addresses assigned but router was sending icmp responses with private ip that was bound to management interface (not reachable from public internet).

1
  • +1 Sounds like a more likely explanation to me Aug 28, 2009 at 14:02
2

It's possible it's passing through someone's internal network, over MPLS or something similar, where they're using internal IPs.

2

I agree with Cian. Sometimes these WAN Hops have a loopback private IP address. For some reason this is returned in the tracert. A program called Wireshark (really good freeware) might give you more insight into your networking problem.

Manni

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .