2

Firstly sorry if this question has already been asked.
While playing with traceroute, I came across something really strange...

traceroute to 185.75.143.25 gives:

 - 10.214.255.254
 - 10.255.255.254
 - 194.199.227.254
 - 10.230.12.197
 - 193.51.182.190
 - 193.51.177.18
 - 193.51.177.16
 - 193.51.177.217
 - 193.51.177.144
 - 195.42.144.43
 - 185.39.168.1
 - 185.39.168.70
 - 185.39.168.21
 - 185.39.168.17
 - 185.75.143.25

The first two private addresses are the routers of my university. But what about the fourth adress : 10.230.12.197
I thought that private adresses can't be routed, so what is this adress doing here?

  • 1
    Private addresses can be routed, just not on the public Internet. That address could be inside the network or in the ISP's network. Unfortunately, questions about networks that you don't control are explicitly off-topic here. – Ron Maupin Oct 31 '16 at 13:28
6

Traceroute deliberately sends packets with low time-to-live values to make the routers between you and your destination send back ICMP TTL exceeded messages. The traceroute output is basically the list of source IP addresses sending these TTL exceeded messages.

So the output tells you the 4th router has sent you a message from a private IP address. This is not a problem, your packets can be routed over links using private IP addresses.

Routers typically forward packets sent by others, but in this case, the router itself generates a packet to send back to you. The router has to decide which source address to send the packet from.

There are no rules on which source address to select. A common default is to use the IP address of the router's outgoing interface on which the packet will be sent. In this example, that tells us that the link between the third and fourth router uses private addresses.

The packet with source address 10.230.12.197 is routed to your computer. It is not possible for you to reply to this device using that address, but it is also not necessary for you to be able to send traffic to this router directly.

The administrator of the router with 10.230.12.197 could/should configure it to use an internet-routable address as the source. This would make the traceroute output cleaner and more meaningful.

Note that in this case it might be possible for you to reach this specific router directly if it is part of the internal network of your organisation. If it is not inside your organisation, there should be a firewall preventing packets coming from the internet with private source addresses, but a private source address could work if no such filtering is being done.

1

Private (RFC 1918) IP address can be routed, but not over the public Internet. Similarly, public addresses can exist on "private" networks. And that is the case here: You don't hit the Internet until the 11th hop.

Edit: As @SanderSteffan points out, there can be links with private addresses on links within public networks. When the TTL expires, the device with a private address sends a ttl-expired message with the private source address.

  • You don't hit the Internet until the 11th hop. Maybe a stupid question, but how can you determine that? – priesto Oct 31 '16 at 14:53
  • Looking up the addresses with Whois. – Ron Trunk Oct 31 '16 at 14:54
  • This is not correct. Gerben's answer is the correct one. Renater is "just" a network, and any network can potentially send ICMP messages from private addresses, usually because a link on the path uses private addresses. This is not uncommon. – Sander Steffann Oct 31 '16 at 20:29
-1

The traceroute command give you all the hop(routers,nodes ect) that your packet travel from you to your destination.

  • Perhaps you could improve your answer so that it answers the question the OP asked. – Ron Trunk Oct 31 '16 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.