I'm doing some research on users connected to Internet via cable operators and I've seen some unusual route traces.
A bit about setup:
Basically user has a home router connected to a DOCSIS modem. The router seems to receive a public IP address from the modem for its WAN interface using DHCP, but when traceroute is done, there is a number of routers in the path which have private IP addresses.
Example traceroute output:
Tracing route to google.com [126.96.36.199] over a maximum of 30 hops: 1 3 ms 1 ms 1 ms 192.168.1.1//This router has public WAN address 2 10 ms 12 ms 8 ms 10.14.0.1 3 11 ms 19 ms 9 ms bg-he-m-1-pc2.sbb.rs [188.8.131.52] 4 12 ms 11 ms 11 ms bg-he-m-1-pc2.sbb.rs [184.108.40.206] 5 12 ms 11 ms 12 ms cache.google.com [220.127.116.11] Trace complete.
I've seen some examples on other providers as well which use the 18.104.22.168/12 addresses. The private addresses are always right after the user's CPE.
Some of my thoughts on this:
As far as I understand it, it shouldn't be possible to route private addresses over public Internet and all routers on the Internet should drop packets with private IP address destinations. I'm aware that the routers with private addresses here are in ISP's network, but I still don't understand how this all works.
I expect that there is some sort of tunneling involved, but I believe that in that case only tunnel endpoints would be visible. The other option would be carrier grade NAT. I'm not sure how that would look like. From what I've heard (but I could be wrong), in CGN systems, users usually can't directly access the Internet and can't be directly accessed from the Internet. In setup I've seen, I can connect to user from the Internet using its IP address normally.
After this rather long exposition, I've come to point where I should present the actual question:
I'd like to know which technology is used here to enable such a setup? A little bit about architecture and some keywords for Google would be helpful as well.