Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In trying to diagnose a failover problem with my Cisco ASA 5520 firewalls, I ran a traceroute to and, much to my surprise, some of the hops came back as RFC 1918 addresses.

Just to be clear, this host is not behind my firewall and there is no VPN involved. I have to connect across the open internet to get there.

How/why is this possible?

asa# traceroute

Tracing the route to

 1  <redacted>
 2  <redacted>
 3  <redacted>
 4  <redacted>
 5 ( 0 msec 10 msec 10 msec
 6 0 msec 0 msec 10 msec
 7 10 msec 0 msec 10 msec
 8   *  *  *
 9 30 msec 30 msec 50 msec
 10 30 msec 30 msec 30 msec
 11 30 msec 30 msec 30 msec
 12 40 msec 30 msec 30 msec
 13 30 msec 40 msec 40 msec
 14 30 msec 30 msec 30 msec
 15  *  *  *
 16  *  *  *
 17  *  *  *

and it does the same thing from my FiOS connection at home:


Tracing route to []
over a maximum of 30 hops:

  1     1 ms    <1 ms    <1 ms  myrouter.home []
  2     8 ms     7 ms     8 ms  <redacted>
  3    10 ms    13 ms    11 ms  <redacted>
  4    12 ms    10 ms    10 ms []
  5    16 ms    16 ms    15 ms  0.ae4.XL2.MIA19.ALTER.NET []
  6    14 ms    16 ms    16 ms  0.xe-11-0-0.GW1.MIA19.ALTER.NET []
  7    19 ms    16 ms    16 ms []
  8    27 ms    33 ms     * []
  9     *        *        *     Request timed out.
 10    44 ms    43 ms    43 ms
 11    42 ms    41 ms    40 ms
 12    42 ms    43 ms    43 ms
 13    42 ms    41 ms    42 ms
 14    40 ms    40 ms    41 ms
 15     *        *        *     Request timed out.
share|improve this question
up vote 10 down vote accepted

It is permissible for routers to connect to each other using RFC1918 or other private addresses, and in fact this is very common for things like point-to-point links, and any routing that takes place inside an AS.

Only the border gateways on a network actually need publicly routeable IP addresses for routing to work. If a router's interface doesn't connect to any other ASes (or any other service providers, more simply), there is no need to advertise the route on the internet, and only equipment belonging to the same entity will need to directly connect to the interface.

That the packets return to you this way in traceroute is a slight violation of RFC1918, but it isn't actually necessary to use NAT for these devices as they don't connect to arbitrary things on the internet themselves; they just pass along traffic.

That the traffic takes the (possibly circuitous) route through several organizations that it does is merely a consequence of the operation of exterior gateway routing protocols. It seems perfectly reasonable that Microsoft has some backbone and some people have peered with it; you don't have to be a wholesale ISP to route traffic.

That the traffic has gone through multiple series of routers with private IPs, transiting through ones with public IPs in between, is not especially strange - it simply indicates (in this case) two different networks along the path have routed the traffic through their own routers which they have chosen to number in this way.

share|improve this answer

Not just RFC 1918...also RFC 6598, i.e. CGN space. Both of those are private networks, but the latter is more recently standardized and less known.

This isn't unusual from a traceroute standpoint. You aren't actually talking to those 10space and 100space hosts directly, you're sending packets with incrementally larger TTLs to your next hop router. To keep the answer from getting overly long, this Wikipedia link summarizes the process.

What is unusual is that that this packet traverses public IP space, and is then tunneled through private IP space to reach a "public" net yet again. is owned by Microsoft, and the packet traverses MS owned networks before hitting the private it's simply what Microsoft is choosing to do with their network space at both ends of the private space. They advertise the routes; the other routers just do what they're told.

As a general rule, no, network operators generally do not expose their private nets along a route to public IP space from outside of their network. That's why this is so unusual.

(it could be a missing route somewhere on their border, causing the packets to traverse a non-optimal path that eventually reaches its destination, but I'm not a networking guy and someone can probably take a better stab at it)

share|improve this answer
Most traceroute implementations rely on UDP+ICMP as your article goes on to state. – dmourati Jun 25 '13 at 2:13
@dmourati As a Unix admin, I'm forced to blush. Duh. Thank you. – Andrew B Jun 25 '13 at 2:15
In my experience, this isn't unusual at all. Many carriers use inside their network, and expose a disturbing amount of it. – Paul Gear Jun 26 '13 at 22:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.