Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Client computer has only one nic configured with

ip: 192.168.1.3/24
gw: 192.168.1.4 
dns: x.x.x.x
OS: winxp

'Gateway' computer has only one nic configured with

ip: 192.168.1.4/24 
gw: 192.168.1.100 
dns: x.x.x.x
OS: winxp

x.x.x.x is an ISP dns provider

192.168.1.100/24 is the lan interface ip of a typical router/AP that has a public IP on the wan interface and does NAT for lan clients.

Client computer has normal internet conectivity.

route print in Client computer lists a number of entrys like this for every host Client is/has connected to:

74.125.47.106  255.255.255.255  192.168.1.100   192.168.1.3     xx
207.46.232.182  255.255.255.255  192.168.1.100   192.168.1.3     xx
hhh.hhh.hhh.hhh  255.255.255.255  192.168.1.100   192.168.1.3     xx
hhh.hhh.hhh.hhh  255.255.255.255  192.168.1.100   192.168.1.3     xx

hhh.hhh.hhh.hhh: other host that computer is/has connected xx: can't remember metric atm, nothing special I think

Looks like some routing protocol is involved but this is new to me and not precisely a standard setup.


Edit: This is my question and maybe it is not clear: The static point-to-point routes appear automatically on 'client' computer as you browse or open connections. The kind of answer i'm expecting is like this: "Gateway computer seems to be running X software/protocol/service that provides the static routes automatically to Client. Client is also probably configured with X mode/protocol/software"

share|improve this question

migrated from stackoverflow.com Jan 19 '10 at 2:03

This question came from our site for professional and enthusiast programmers.

8  
Other than "a poor one", what sort of answer are you actually expecting here? –  womble Jan 19 '10 at 2:08

3 Answers 3

It's routing with ICMP redirect.

Here's what's going on (likely, use tcpdump/wireshark to verify on either the client computer or the client's gateway):

  1. Client (.3) says "I have a packet to send to one of google's IPs."
  2. Client looks up via ARP, doesn't find the IP.
  3. Client looks up in its route table, doesn't find the IP.
  4. Client sends the packet to its configured gateway.
  5. Configured gateway (.4) looks up via ARP, doesn't find the IP.
  6. Configured gateway looks up in its route table, doesn't find the IP.
  7. Configured gateway looks at the upstream gateway (.100), notices that it's on the same Ethernet segment
  8. Configured gateway sends an ICMP redirect to the client, informing it that the gateway it really wants is the upstream gateway (.100)
  9. Client re-sends the packet to the upstream gateway
  10. Client adds the more-specific route to it's routing table
  11. Upstream gateway forwards the packet onwards.

As noted by others, the configured gateway can do interesting things rather than send the ICMP redirect, though it appears not to be configured to do so.

share|improve this answer
    
Interesting, this is probably it. Now how do you setup the gateway to do that? What software is the gateway running? –  Vash Feb 2 '10 at 5:43
    
According to RFC1812, the ability to generate these is a requirement if you want to call yourself a "router"---of course, that RFC was authored by a Cisco engineer, who's devices come with ICMP redirects enabled by default (there's a global "no ip igmp-redirect" or something to disable it IIRC)... So it's going to be whatever bit of software is on the box that's making decisions about how to rewrite a packet between interfaces... –  James Cape Feb 2 '10 at 11:48
    
If you're going to use google (or any other name) in your example, then DNS resolution has to occur between steps 1 and 2. Either from the local DNS cache or from the DNS client resolver via it's configured DNS server. –  joeqwerty Feb 4 '11 at 4:08
    
joeqwerty: I'm using the term "google" coloquially, to refer to "a server that google owns/controls". –  James Cape Feb 4 '11 at 14:09
    
@joeqwerty: And though it shouldn't need to be said, revenge downvoting based on an obviously pedantic misreading just makes you look like a complete tool. –  James Cape Feb 4 '11 at 14:19

I'm not really sure I understand the question.

But at a guess I'd say that the machine 192.168.1.4 could be running something like internet acceleration server. I've noticed that SBS etc seem to set themselves up like this. i.e. one NIC, no real firewalling as such.

Is that the kind of answer you were expecting?

share|improve this answer
    
Yes, this is the kind of answer I'm expecting. Learn what are the pieces involved in this setup and what is the purpose of using something like that. One question:By SBS you mean Small Business Server? Gateway comp is running windows xp, not entirely sure but isn't SBS windows server OS based? –  Vash Jan 19 '10 at 3:11
    
Yes SBS = Windows Small Business Server –  Matt Jan 19 '10 at 19:25

The two IP addresses you provided are owned by Google and Microsoft:

$ whois 74.125.47.106
[Querying whois.arin.net]
[whois.arin.net]

OrgName:    Google Inc. 
OrgID:      GOGL

NetRange:   74.125.0.0 - 74.125.255.255 
CIDR:       74.125.0.0/16 
NetName:    GOOGLE

and

$ whois 207.46.232.182
[Querying whois.arin.net]
[whois.arin.net]

OrgName:    Microsoft Corp 
OrgID:      MSFT

NetRange:   207.46.0.0 - 207.46.255.255 
CIDR:       207.46.0.0/16 
NetName:    MICROSOFT-GLOBAL-NET

Maybe some browser plugins set these, but they look really strange to me.

Did you alread check what services are running on 192.168.1.4?

share|improve this answer
    
The addresses where put there by me as an example. I have not the actual data but you get the idea, for every connection is made a static point to point route is spawned in routing table of client. About the services running, I found a squid server running, then I stopped it and observed no change, no conectivity lost, everything stays the same. I also verified no proxy setup in the browser I was using. –  Vash Jan 19 '10 at 13:43
    
OK. Is it really for every connection or only for every connection made by the browser? Does e.g. Skype generate static entries too? Can you test with "netstat" what you have running on the machines? –  Raffael Luthiger Jan 19 '10 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.