Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I ran the following traceroute once, while trying to disagnose a network problem.

c:\>tracert linode.com -d

Tracing route to linode.com [67.18.186.61]
over a maximum of 30 hops:

  1    <1 ms     *       <1 ms  10.43.51.252
  2     1 ms    <1 ms    <1 ms  10.45.253.33
  3    <1 ms    <1 ms    <1 ms  10.62.254.251
  4    20 ms    23 ms    45 ms  192.118.32.52
  5    47 ms    20 ms    85 ms  207.232.60.250
  6    54 ms    24 ms    79 ms  212.143.8.69
  7     7 ms    79 ms    11 ms  212.143.8.209
  8    89 ms   110 ms   108 ms  212.143.12.75
  9   143 ms   240 ms    94 ms  212.143.14.154
 10   244 ms   179 ms    95 ms  10.50.1.1
 11   176 ms    80 ms   190 ms  195.66.225.105
 12   174 ms   164 ms   157 ms  70.87.255.217
 13   187 ms   185 ms   186 ms  70.87.253.189
 14   189 ms   194 ms   195 ms  70.87.253.18
 15   187 ms   188 ms   190 ms  70.87.253.126
 16   187 ms   185 ms   185 ms  70.87.254.78
 17   186 ms   184 ms   187 ms  67.18.186.61

Trace complete.

The first three sites are local routers / gateways; ignore those.

I'm not sure, however, how step 10 could give me 10.50.1.1 as a target? Isn't that an unroutable IP that shouldn't be anywhere to be found from a public router?

share|improve this question
add comment

5 Answers

up vote 10 down vote accepted

RFC1918 addresses (10/8, 172.16/12 and 192.168/16) should not appear in global routing tables, as they're designed to be used within "a single enterprise". However, it makes sense, to some extent, using RFC1918 addresses for your point-to-point links within your core, even if the traffic going across those links are for "globally routable" IP address ranges, as this conserves a slightly scarce resource.

The reason it shows up in the traceroute is that the TTL of an IP frame expired on an interface with that as its interface IP. The down-side of doing this is that it gets harder to ping the interface and do some troubleshooting on the issue, but there is no guarantee that you should be able to do that anyway.

So, I'd say that it may be a bit unusual, but it's certainly not unheard of.

share|improve this answer
    
interesting... thanks! –  Mikeage Aug 28 '09 at 5:26
    
I have used a prefix from private address space "temporarily" (for a few months) for an asymmetric route. The clients were puzzled because with traceroute from they computers to internet they were seeing the private IP, but from internet to their IP, the private IP was not showing. –  Mircea Vutcovici Apr 9 '10 at 19:26
add comment

That does seem odd to me. It is perfectly okay too see private IPs in the middle of a route, because a single organization can use a private IP within their network. But according to whois, 212.143.14.154 and 195.66.225.105 are owned by two different organizations. But maybe these two orginizations have a point to point between each other, in which case the could use a private IP for it.

The term non routable is not entirely accurate, because they can be routed. However, the should only be used by a single 'enterprise', the term RFC1918 uses. Which is why I find this a bit odd.

share|improve this answer
2  
Of course, whois is not really that reliable –  Kyle Brandt Aug 27 '09 at 12:58
    
they could have a PTP link, but since one is an Israeli ISP [corporate connection, in this case] and one is a major US hosting provider [theplanet.com], it seems kind of strange. –  Mikeage Aug 28 '09 at 5:27
add comment

I saw it happening on some juniper routers. They had proper public ip addresses assigned but router was sending icmp responses with private ip that was bound to management interface (not reachable from public internet).

share|improve this answer
    
+1 Sounds like a more likely explanation to me –  Kyle Brandt Aug 28 '09 at 14:02
add comment

It's possible it's passing through someone's internal network, over MPLS or something similar, where they're using internal IPs.

share|improve this answer
add comment

I agree with Cian. Sometimes these WAN Hops have a loopback private IP address. For some reason this is returned in the tracert. A program called Wireshark (really good freeware) might give you more insight into your networking problem.

Manni

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.