0

I just check my IP routing? and it turns to be:

IP:10.29.66.27 -> 172.39.29.71 -> x.x.x.x my outmost IP, which I get by Google "my ip".

As far as I know, 172.16.0.0/12 is the one of the 3 private networks.

I also check on https://stat.ripe.net/172.39.29.71#tabId=at-a-glance, showing that 172.39.29.71 is a public IP address.

traceroute to bing.com (13.107.21.200), 30 hops max, 60 byte packets
 1  _gateway (192.168.0.1)  0.144 ms  0.121 ms  0.111 ms
 2  192.168.1.1 (192.168.1.1)  0.607 ms  0.759 ms  0.872 ms
 3  172.39.0.1 (172.39.0.1)  3.551 ms  3.687 ms  4.160 ms
 4  183.233.126.105 (183.233.126.105)  4.961 ms  5.290 ms  5.297 ms
 5  211.136.251.117 (211.136.251.117)  6.699 ms 211.136.248.233 (211.136.248.233)  6.059 ms 211.136.251.117 (211.136.251.117)  6.786 ms
 6  221.183.13.173 (221.183.13.173)  11.368 ms 221.183.13.169 (221.183.13.169)  8.025 ms 221.183.24.69 (221.183.24.69)  7.992 ms
 7  221.176.22.114 (221.176.22.114)  8.922 ms  59.970 ms 221.176.24.102 (221.176.24.102)  81.269 ms
 8  221.176.24.58 (221.176.24.58)  32.300 ms  39.858 ms  38.047 ms
 9  221.183.30.142 (221.183.30.142)  41.418 ms 221.183.30.138 (221.183.30.138)  32.966 ms 221.183.21.6 (221.183.21.6)  33.817 ms
10  223.118.2.202 (223.118.2.202)  18.240 ms  17.844 ms  18.197 ms
11  223.119.0.174 (223.119.0.174)  18.532 ms  18.125 ms  16.849 ms
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

3 Answers 3

4

Private IPv4 address blocks were allocated in RFC 1918:

  • 192.168.0.0/16
  • 172.16.0.0/*12*
  • 10.0.0.0/8

172.32.0.0/11 is owned by T-Mobile USA, according to Whois.

Your ISP can assign any IP address they own to any device or customer anywhere, regardless of which country it's registered in.

Based on your ping time, 172.39.0.1 is very close to you (<200 km). Fiber communication travels at 200,000 km/s (speed of light divided by refractive index), so within 3.5 ms you can't possibly ping a node more than 300 km away from you.

Actually, anyone can use any IP address anywhere - while that is technically possible, it creates a routing problem: if you use a public IP range in your internal network you'll set your routers to forward internally instead of towards the Internet.

When packets are sent to the true public IP address they'll end up being forwarded to the internal network instead. Therefore, using public IPs in your network disables communication with the real public addresses (unless you use elaborate workarounds like policy-based routing by source address or L4 destination port).

So, the use of 172.39.0.1 in a network that obviously isn't T-Mobile USA may or may not be legitimate. However, speculation is off-topic here on NE.

7
  • Can they still NAT this ip to the real public ip? I know my computer knows visiting localhost is visiting itself. But I don't know what would happen if the computer visits his assigned LAN ip. Will it, I guess for example, go ask the router who is 172.39.29.71 and the router/gateway coul tell/fool it and tell it go out to find the real 172.39.29.71 in the public network? Thanks.
    – Rick
    Jul 3, 2019 at 15:36
  • NAT is normally used between private and public IP addressing. Since that already is a valid public IP there's no reason to NAT it to another public IP. A router has to have a route towards the destination - that can be a simple default route or a specific route. A router can route packets to any of its neighbor gateways or to any host within on of its local subnets (without NAT).
    – Zac67
    Jul 3, 2019 at 15:57
  • 1
    172.39.0.1 is in USA and now I am in HongKong.. That's far more than 200km. I think it's more likey that my ISP uses 172.39.29.71 as a LAN ip, less likely that I am actually connecting to the US 172.39.29.71 along the route path.
    – Rick
    Jul 3, 2019 at 16:14
  • I know NAT is normally used between private and public IP addressing. But technically speaking, can it for example I use 172.39.29.71 inside a LAN and still can route to the outside 172.39.29.71, if I visit 172.39.29.71 from my browser?
    – Rick
    Jul 3, 2019 at 16:16
  • 1
    @rick 172.39.0.1 is registered in USA but obviously near you. A ping time of 3.5 ms to the US from Hongkong is physically impossible. Light in fiber travels at 200,000 km/s and within 3.5 ms it can't travel more than 350 km and back. If you use a public IP within your network you can't reach the real public host any more. A router can only forward a packet in one direction.
    – Zac67
    Jul 3, 2019 at 16:41
6

172.16.0.0/12 goes from 172.16.0.0 to 172.31.255.255. Therefore, 172.39.29.71 is a public IPv4.

8
  • Yes, but my ISP is giving me a public IPv4 on the local network. I am confused.
    – Rick
    Jul 3, 2019 at 13:04
  • 1
    From you post, I assume that your IP is 10.29.66.27 which is a private IPv4. 172.39.29.71 is a device in the path from your computer to Internet, which is probably one of your ISP router.
    – Nakrule
    Jul 3, 2019 at 13:06
  • 1
    Yes, but I live in HongKong. And 172.39.29.71 is a USA ip. Why would my ISP connect me to USA first ?
    – Rick
    Jul 3, 2019 at 13:15
  • 1
    But technically, I can use any ip in a local network, is that right? And the result is that those public IP I used would be blocked.
    – Rick
    Jul 3, 2019 at 13:17
  • Yes, you can use any private IPv4 inside your LAN. For you other remark, there is several other devices in the path that probably does not answer to ICMP echo and are not shown in your traceroute.
    – Nakrule
    Jul 3, 2019 at 13:20
2

Some sysadmins forget the /12 part and mistakenly assume that all of 172.x.x.x (i.e. the whole /8) is reserved for private use. So when a newbie admin at your ISP ran out of 172.[16-31].x.x for their core network, they probably just kept going and probably started using 172.32.x.x, 172.35.x.x, etc.

(Because it's their own network and their own routers, they can technically configure any address range they want: there's no magic enforcement mechanism. (You can also configure any LAN prefix you want, even if it's not yours.) So they did not notice the issue.)

So if that's the case, there are two possibilities:

  • You cannot reach the real T-Mobile 172.39.0.1 through this ISP at all, and must use a VPN/tunnel through some other ISP in order to jump over these routers. You cannot simply "NAT" your way through it, because the problem is outside your network.

  • You can reach the real T-Mobile 172.39.0.1 through this ISP just fine, because your ISP has a separate set of routes (VRF) for management and for Internet access.

Do not trust the traceroute output for an unrelated address to tell you which is which. (Even though the ISP's router might be sending you responses from 172.39.0.1, that says nothing about what happens to packets you send to the same 172.39.0.1. It's somewhat common for traceroute answers to come from addresses that would be completely impossible to reach.) To know for sure whether the correct host is accessible, ping/traceroute that specific address.

Not the answer you're looking for? Browse other questions tagged or ask your own question.