-
November 4th, 2005, 07:33 AM
#1
Identifying myself in a network?
Here's the situation. So the other day, I'm fooling around with traceroute and ping, and I notice that the second hop for each of my is the ip address 10.10.0.1. So realizing this is an internal IP, I start poking around. So I do a ping sweep of 10.10.0.1-255, and see a bunch of hosts up. So most likely this is some router at my ISP. I'm behind a router on a 192.168.0.x network, with the router being 192.168.0.1 and the gateway.
What I am wanting to figure out is which of the 10.10.0.x addresses is my cable modem. I don't seem to ever get a hop on the cable modem. It always goes from 192.168.0.1 to 10.10.0.1. From my router's status page I see my external IP address (internet address, not a 10.10.0.x address) and my default gateway and DNS servers. For a while I was confused about why I was never getting the address my router was saying is my default gateway in my hops. Then I think I figured it out.
Code:
root@slax:~# ping -c 1 87.16.192.1 -t 1
PING 87.16.192.1 (87.16.192.1) 56(84) bytes of data.
From 192.168.0.1 icmp_seq=1 Time to live exceeded
--- 87.16.192.1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
root@slax:~# ping -c 1 87.16.192.1 -t 2
PING 87.16.192.1 (87.16.192.1) 56(84) bytes of data.
64 bytes from 87.16.192.1: icmp_seq=1 ttl=254 time=8.20 ms
--- 87.16.192.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 8.203/8.203/8.203/0.000 ms
root@slax:~# ping -c 1 10.10.0.1 -t 1
PING 10.10.0.1 (10.10.0.1) 56(84) bytes of data.
From 192.168.0.1 icmp_seq=1 Time to live exceeded
--- 10.10.0.1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
root@slax:~# ping -c 1 10.10.0.1 -t 2
PING 10.10.0.1 (10.10.0.1) 56(84) bytes of data.
64 bytes from 10.10.0.1: icmp_seq=1 ttl=254 time=8.64 ms
--- 10.10.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 8.648/8.648/8.648/0.000 ms
So now I'm pretty sure that 87.16.192.1 and 10.10.0.1 are different interfaces on the same device, which I think is a switch or hub or router at my ISP. But I'm still left with the question of which 10.10.0.x IP address is my cable modem. So far I could only think of one way to try and determine this. My neighbor is on the same 10.10.0.x net as me, so from his house I did two ping sweeps with my cable modem plugged in, both of which came up with the same hosts up. Then I unplugged my cable modem and did two more ping sweeps shortly after. There was no change in the hosts reported up. So that attempt at identifying my modem failed. Now I am asking you all if you can think of any way to identify myself among this network. Any ideas are appreciated. Thank you.
P.S. For those of you asking why I care about this, I'm not sure. I guess I'm just curious. Also, I changed most of the IP's, but they should still make sense as for what they represent.
-
November 4th, 2005, 08:35 AM
#2
Can you post the traceroutes, an ifconfig and a netstat -r of your computer.
What type of broadband do you have ? DSL, cable, dial-up ?
-
November 4th, 2005, 10:21 AM
#3
Not sure if your cable works the same as cable in the UK but your modem will usually be an integral part of your router, hence the ip addy that your ISP has assigned you will be the ip that your modem uses. therfore you wont get a "hop" on your modem so to speak, just your router, which you are getting as your default gateway.
the 10 .x.x.x ip's will be your ISP's server that you log into as it is the second entry in your trace route, the first entry should nearly always be your default gateway after that following a logical path willl be your isp server maybe an isp proxy after that and then the tinternet!
-
November 4th, 2005, 04:55 PM
#4
I have cable.
Code:
[root@h3r3tic1 ~]# traceroute google.com
traceroute: Warning: google.com has multiple addresses; using 72.14.207.99
traceroute to google.com (72.14.207.99), 30 hops max, 38 byte packets
1 192.168.0.1 (192.168.0.1) 2.265 ms 1.334 ms 1.251 ms
2 10.10.0.1 (10.10.0.1) 11.879 ms 7.644 ms 7.808 ms
[omitted, stuff out on the internet eventually hitting 72.14.207.99]
[root@h3r3tic1 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:04:5A:6A:86:58
inet addr:192.168.0.201 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::204:5aff:fe6a:8658/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1903482 errors:0 dropped:0 overruns:0 frame:0
TX packets:587564 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:599823052 (572.0 Mb) TX bytes:354592573 (338.1 Mb)
Interrupt:3 Base address:0xb800
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:204882 errors:0 dropped:0 overruns:0 frame:0
TX packets:204882 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:30188167 (28.7 Mb) TX bytes:30188167 (28.7 Mb)
sit0 Link encap:IPv6-in-IPv4
inet6 addr: ::127.0.0.1/96 Scope:Unknown
inet6 addr: ::192.168.0.201/96 Scope:Compat
UP RUNNING NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
[root@h3r3tic1 ~]# netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
Hopefully I didn't omit too much from the traceroute. It took 16 hops.
-
November 4th, 2005, 05:17 PM
#5
OK donkey, your cable modem is prolly in bridge mode. If this is the case, then you will not see the hop.
Also, you can get your cable modem IP addys by simply logging into the device or, look at the WAN side of your SOHO router, this will give you the "internal" interface of your cable modem. Then go to a site like whatismyip.com and it will give you the "external" addy of the cable modem. My guess is that you're going to see that the external IP of the cable modem will show up as the WAN interface on your SOHO router.
Stop hogging up all the stupid.
--TH13
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
-
November 4th, 2005, 10:36 PM
#6
I can't login to the cable modem if I don't know which IP it is.
The WAN ip given in my router is the same as my IP on the internet. I'm trying to figure out which 10.10.0.x IP corresponds to my cable modem. Nothing in my router's web config has said anything about that and that's the only interface (user interface not network interface) it has.
I do have the MAC address of my cable modem. I'm thinking there's probably a way to figure out which 10.10.0.x IP belongs to the same MAC address as my cable modem. I'll look into figuring that out when I get home. Hopefully it's what I need. In the meantime, I'm still open to suggestions.
Also, anyone is welcome to as much of the stupid as they want. I didn't realize I was hogging it.
-
November 5th, 2005, 12:59 AM
#7
You are hogging all the stupid. You just confirmed that you have a bridge mode cable modem by saying this:
The WAN ip given in my router is the same as my IP on the internet.
Since this is the case, what the hell do you care which interface it is? If you know the manufacturer of the nic on your modem, go look it up here:
http://www.coffer.com/mac_find/
Stop being a tool.
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
-
November 5th, 2005, 10:37 AM
#8
Damnit thehorse13 every point I was going to make you made!haha! I work for an isp and they use 10 based addresses for there modems. Basicly so we can ping the modem, check the status, see if anythings connected, check the bandwidth usage, and other pettie fun things like that. Im sure most of you knew that. The only thing I could say off the top of my head is depending on the modem trying pinging 192.168.100.1 Im not sure if this is a standard but I do know some modems follow this. If you get replys from this and its _not_ your local lan. Then try connecting to it via http (http://192.168.100.1) it will look something like so...
-
November 5th, 2005, 11:53 AM
#9
"pettie fun things"
I'm more interested in the ISPs "deep inspection packets" article in Newsweek I read. "It's for the kid on P2P, juicing 3 teraflops in bandwidth a month."
-
November 5th, 2005, 12:34 PM
#10
trying pinging 192.168.100.1 Im not sure if this is a standard but I do know some modems follow this.
Actually, it's not a standard. For instance, mine uses 192.168.254.254.
I do wish we could chat longer, but I'm having an old friend for dinner.
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|