I ran the following traceroute once, while trying to disagnose a network problem.

c:\>tracert linode.com -d

Tracing route to linode.com []
over a maximum of 30 hops:

  1    <1 ms     *       <1 ms
  2     1 ms    <1 ms    <1 ms
  3    <1 ms    <1 ms    <1 ms
  4    20 ms    23 ms    45 ms
  5    47 ms    20 ms    85 ms
  6    54 ms    24 ms    79 ms
  7     7 ms    79 ms    11 ms
  8    89 ms   110 ms   108 ms
  9   143 ms   240 ms    94 ms
 10   244 ms   179 ms    95 ms
 11   176 ms    80 ms   190 ms
 12   174 ms   164 ms   157 ms
 13   187 ms   185 ms   186 ms
 14   189 ms   194 ms   195 ms
 15   187 ms   188 ms   190 ms
 16   187 ms   185 ms   185 ms
 17   186 ms   184 ms   187 ms

Trace complete.

The first three sites are local routers / gateways; ignore those.

I'm not sure, however, how step 10 could give me as a target? Isn't that an unroutable IP that shouldn't be anywhere to be found from a public router?


RFC1918 addresses (10/8, 172.16/12 and 192.168/16) should not appear in global routing tables, as they're designed to be used within "a single enterprise". However, it makes sense, to some extent, using RFC1918 addresses for your point-to-point links within your core, even if the traffic going across those links are for "globally routable" IP address ranges, as this conserves a slightly scarce resource.

The reason it shows up in the traceroute is that the TTL of an IP frame expired on an interface with that as its interface IP. The down-side of doing this is that it gets harder to ping the interface and do some troubleshooting on the issue, but there is no guarantee that you should be able to do that anyway.

So, I'd say that it may be a bit unusual, but it's certainly not unheard of.

  • I have used a prefix from private address space "temporarily" (for a few months) for an asymmetric route. The clients were puzzled because with traceroute from they computers to internet they were seeing the private IP, but from internet to their IP, the private IP was not showing. – Mircea Vutcovici Apr 9 '10 at 19:26

That does seem odd to me. It is perfectly okay too see private IPs in the middle of a route, because a single organization can use a private IP within their network. But according to whois, and are owned by two different organizations. But maybe these two orginizations have a point to point between each other, in which case the could use a private IP for it.

The term non routable is not entirely accurate, because they can be routed. However, the should only be used by a single 'enterprise', the term RFC1918 uses. Which is why I find this a bit odd.

  • 2
    Of course, whois is not really that reliable – Kyle Brandt Aug 27 '09 at 12:58
  • they could have a PTP link, but since one is an Israeli ISP [corporate connection, in this case] and one is a major US hosting provider [theplanet.com], it seems kind of strange. – Mikeage Aug 28 '09 at 5:27

I saw it happening on some juniper routers. They had proper public ip addresses assigned but router was sending icmp responses with private ip that was bound to management interface (not reachable from public internet).

  • +1 Sounds like a more likely explanation to me – Kyle Brandt Aug 28 '09 at 14:02

It's possible it's passing through someone's internal network, over MPLS or something similar, where they're using internal IPs.


I agree with Cian. Sometimes these WAN Hops have a loopback private IP address. For some reason this is returned in the tracert. A program called Wireshark (really good freeware) might give you more insight into your networking problem.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.