Private IPs

I received an announcement (if you can call it that) from AnalogX stating an attempt was made to access my computer through port 21. I ran a Tracert on the IP with the following results:

Tracing route to 210.126.214.185 over a maximum of 30 hops

1 125 ms 109 ms 125 ms nas2.sr2.sonic.net [209.204.168.85]
2 109 ms 125 ms 125 ms fe-6-1.gw.sr2.sonic.net [209.204.168.81]
3 157 ms 172 ms 171 ms tunnel-sr2.sonic.net [208.201.245.161]
4 156 ms 157 ms 156 ms fast1-0-0.border.sr.sonic.net [208.201.224.194]
5 172 ms 156 ms 172 ms fast0-0.gw.equinix-sj.sonic.net [64.142.0.14]
6 172 ms 188 ms 187 ms SNTCCA4LCX1.14.0.wcg.com [206.223.116.83]
7 172 ms 172 ms 172 ms sntcca4lcx1-pos.wcg.net [64.200.151.25]
8 156 ms 172 ms 157 ms sntcca2lce1-pos6-0.wcg.net [64.200.151.129]
9 172 ms 156 ms 172 ms sntcca1wcx2-pos.wcg.net [64.200.240.101]
10 157 ms 172 ms 171 ms sntcca1wcx1-oc48.wcg.net [64.200.151.109]
11 297 ms 297 ms 297 ms sntcca1wcx1-samsung-pos.wcg.net [64.200.150.38]
12 312 ms 313 ms 297 ms seoul1-cgr2.kr.psi.net [203.255.119.14]
13 297 ms 297 ms 297 ms 210.122.160.250
14 297 ms 312 ms 297 ms 10.250.1.110
15 328 ms 328 ms 297 ms 210.126.214.185

Trace complete.

What has me puzzeled is the 10.x.x.x IP in line 14. I was under the imperssion that all 10.x.x.x IPs are private. Is that not correct?

With our Lords blessings,

Doug

i don't belive they are a private ip, i could be wrong. the only "private ip" i think are the 192.168.32.X, only because they are non traceable. i think it's a class 1 ip, so it might be a gov't ip

It's private. 10 is a Class A network and 192.168 is a Class C.

NetRange: 10.0.0.0 - 10.255.255.255
CIDR: 10.0.0.0/8
NetName: RESERVED-10
NetHandle: NET-10-0-0-0-1
Parent:
NetType: Direct Assignment
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Please see RFC 1918 for additional information.


Just a typical ftp scan, no doubt. looking for a place to store some warez or an easy hack.

But, should I be able to see it in the tracert??

It's most likely a misconfigured router somewhere that's allowing a private IP out into the wild. It happens sometimes. Most decent firewalls will detect and drop packets that claim to come from a private address, anyway. I wouldn't worry about it.

Well, if you don't understand what prolbem child and Tedob1 were saying, the 10.x.x.x address is a nonrouteable (private) class A address (Big business). The 192.168.x.x set of addresses mare nonrouteable class C addresses.

There are ways to access nonrouteable comuters. It normally requires a LOT more work then a simple traceroute. If it is showing up in you logs (like it did(...) then the other end didn't configure their router proplerly

I thank all of you for helping me to understand. And Problemchild, I won't worry about it, thanks. I can't help think thought, that 10.250.1.110 should. :)

With our Lords blessings thank you and take care,

Doug

Private address space is certainly routable by routers. 10.x.x.x, 192.168.x.x, and there are several others are private addresses, meaning nobody is allowed to register them and claim ownership of them, which translates into meaning that if you were to use it, you wouldn't be garunteed to reach them outside of your ISP/network. Most ISP's will do ingress/egree filtering to block private addresses from leaving/entering their network, which has the effect of making them non-routable on the INTERNET, this does not mean they are non-routable on your own network/ISP's network.

It is actually quite common to have ISP's use private address space for their routers. The address space works just fine in passing traffic and it gives the added bonus of protecting their routers from the internet by making them non-reachable.

There was a huge thread about this a while back: look here

Nebulus

I don't want to put words into souleman's mouth, but I don't think he was saying it's not possible to route them, because obviously it is or the guy wouldn't be seeing a Class A address in his logs. I think he just meant that it isn't supposed to be done. :D

Well, I didn't mean to start a symantics debate, but what I was getting at is that as long as it is on your internal network or ISP's internal network (and not out on the internet), it is perfectly legal and a perfectly good choice, not to mention a common one. After all why would you want your backbone devices such as routers visible and accessible by people on the internet ? Having them take on private address space will in no way effect the networks and computers that route through them...and it prevents them from being accessed...

neb

problemchild> your putting words in my mouth :P

nebulus2000> private address space in NONROUTABLE. If you put up a machine with a 10.X.X.X address on one side of a router and try to access it from the other side of the router with the 10.X address, it will NOT work. You can not ping 10.250.1.110 (the one Doug Taylor is talking about) because it isn't routed. Large companies will use routers inside their network simply so they can reuse IP addresses. I can have 2 machines on 1 network with the exact same NONROUTABLE PRIVATE

I stand corrected, then. :D

problemchild> your putting words in my mouth :P

nebulus2000> private address space in NONROUTABLE. If you put up a machine with a 10.X.X.X address on one side of a router and try to access it from the other side of the router with the 10.X address, it will NOT work. You can not ping 10.250.1.110 (the one Doug Taylor is talking about) because it isn't routed. Large companies will use routers inside their network simply so they can reuse IP addresses. I can have 2 machines on 1 network with the exact same NONROUTABLE PRIVATE IP address, as long as their is a router between them.

ISP's do not to any filtering to block private addresses from leaving their network, because they can't. They use some form of NAT so that the computer can be seen from outside the network. If you take a machine and plug it directly into the internet and give it a 10.x address, you will NOT be able to access it from another machine.

When you use a router, the router changes the IP address of every machine connected to it on the intranet side into 1 (or sometimes more) public IP address. You can plug in 100 computer all with 10.x ip addresses into 1 router. As far as the internet is concerned, EVERY machine has the exact same ip address, and it is NOT a 10.X address. It is a public address.

In Doug Taylors case, it is most likely that 210.122.160.250 and 10.520.1.110 a router of some type and are both 1 machine. He received the 10.X address because the packet was crafted to show it. It is also possible that it has something to do with the way that his traceroute works. This is my tracerote from a linux box...

Quote:

---

traceroute to 210.126.214.185 (210.126.214.185), 30 hops max, 38 byte packets
1 * * *
2 192.168.69.1 (192.168.69.1) 1970.496 ms 4370.585 ms 3724.938 ms
3 199.190.101.1 (199.190.101.1) 719.873 ms 1043.109 ms 2011.379 ms
4 core-sgnw.midmich.net (63.83.235.1) 2103.533 ms 1528.140 ms 242.203 ms
5 216.183.248.73 (216.183.248.73) 211.648 ms 493.102 ms 463.371 ms
6 atm1-1-0-61.core1.mn.norlight.net (66.84.151.6) 211.014 ms 202.827 ms 233.817 ms
7 p4-1.mpltmn1-cr1.bbnplanet.net (4.25.20.9) 208.672 ms 397.340 ms 223.231 ms
8 p4-0.chcgil2-cr11.bbnplanet.net (4.0.1.18) 247.167 ms 277.321 ms 247.891 ms
9 so-3-1-0.chcgil2-br2.bbnplanet.net (4.24.6.25) 258.975 ms 1185.960 ms 2248.313 ms
10 p1-0.chcgil2-cr2.bbnplanet.net (4.24.9.34) 2442.666 ms 239.175 ms 250.168 ms
11 chcgil1wcx3-atm.wcg.net (64.200.102.57) 269.930 ms 231.257 ms 256.947 ms
12 snfcca1wcx3-oc48.wcg.net (64.200.240.94) 326.120 ms 272.229 ms 267.603 ms
13 sntcca1wcx1-oc48.wcg.net (64.200.151.93) 272.941 ms 1032.834 ms 1297.007 ms
14 sntcca1wcx1-samsung-pos.wcg.net (64.200.150.38) 700.289 ms 437.329 ms 447.083 ms
15 seoul1-cgr2.kr.psi.net (203.255.119.14) 417.367 ms 432.236 ms 410.921 ms
16 c250.higlobe.net (203.255.117.250) 418.768 ms 210.122.160.250 (210.122.160.250) 412.710 ms c250.higlobe.net (203.255.117.250) 404.736 ms
17 * * *
18 210.126.214.185 (210.126.214.185) 429.414 ms 415.288 ms 418.498 ms

---

As you can see, both steps 1 and step 17 are ***. That is because they are nonrouteable IP addresses. Step 1 is my gateway (192.168.1.1) and step 17 is that 10.x box.

I hate to have to be insistent soulman, but we use private IP's on our network devices and it works just dandy. Any valid IP address is routeable by a router if you set it up that way; however, there are conventions setup on the internet, one of which is that private address space shouldn't be routed (and it isn't). I think you are missing the distinction I am trying to make, there are several different layers of routing, there is the routing on your network and there is the routing between your network and the rest of the world (internet). The only place that private address space is not routable is on the internet or between networks (ASN's), within your own network it will work just fine.

I personally have successfully implemented such routing with devices as diverse as sun workstations, to cisco, 3com, and bay routers...If you were having problems getting it to work take a look at your setup. Other than that, I really don't know what to say other than PM me on a setup and I will show you :)

Neb

Wanted to add something about the traceroute. Traceroute can be somewhat unreliable in reporting exact hops, for example, say your router has four interfaces and you trace through that device... I have seen several instances where the IP of one of the other interfaces will actually come back rather than the one you passed through (someone once told me it had to do something with the way it broadcasts things out to determine IP's, but I honestly have no idea, but I have nonetheless witnessed it).

The other thing to keep in mind about traceroute is that their are a multitude of other things that can effect the results returned by traceroute, from packet loss, to filtering devices (firewalls, routers with acl's), to actual physical circuit problems. I am not saying you are wrong, but I am suggesting, that there can easily be other causes for the *** than just the use of private address space...

Neb

nebulus200> Before you start listing your resume, look into NAT, nonrouteable IP addressing, and firewalking. I am not sure why you would set up a sun workstation as a router, but the others all have NAT built in. You didn't even know what you were setting up. The sun workstation might have been a checkpoint system, but I don't really know.

I think you are confusing routing with hubs and switches. There is a BIG difference between a router and a switch. A nonrouteable address means it will NOT go threw a router. It doesn't mean you can't access it from another computer on the same subnet.

If you really want to disagree with me, you can come to irc (irc.antionline.org) and you can talk with a few other people that know what they are talking about...not just me.

irc.antionline.com ;)

Well, last post on this thread, will try something like pm'ing (unfortunately, against use policy to have IRC)...

The sun was actually a firewall, but it nonetheless can act as a router and for a little while in my apartment back in college we used one I had laying around as a router/PPP server (but that was for messing around), the firewall use IMHO is actually quite legit.

I am very much familiar with the differences between routers, switches, hubs, firewalls, nat, etc, etc, etc ad naseum thank you. I would suggest you look into your own suggestions as well. NAT is network address translation and does not necessarily refer to translating only private address space. It can also be used to translate between two sets of legal addresses or a illegal address space to a legal address space (illegal address space is where you have selected to use address space that is not private, that is registered to someone else, yes you can do that, why you would do that boggles my mind, but it is something you can do, so long as you don't advertise out to the rest of the internet that you own that address space), but the point is it is not entirely related to only private address space. Now that I feel that I have cleared that up, if you want to discuss the use of private address space, please PM me (like I said, I can't use IRC), and I will be happy to dicuss this with you.

Nebulus

before I make an intelligent remark to this thread....

What is the exact arguement going on here ?

I hate to drag out a thread you guys have expressed an interest in ending, but just for my own edification, I want be sure I understand what you guys are saying. This is not really my field, and I'm sure that one (or both) of you will correct me if I have this wrong, but......

I know that private address space is often referred to as non-routable space, but I've always been under the impression that this was by convention only and that a router could be configured to route these packets if you so desired. Why you would want to is another story, since you would be unreachable from outside your network, though. I occasionally see private addresses in my logs like Doug did, and I've always chalked it up to a misconfigured router that was routing these packets by mistake.

Souleman - are you saying that it is completely impossible to configure a router to route packets from a private address to another network?

The reason I ask is because the language of RFC 1918 seems to suggest that it is possible:

Quote:

---

Because private addresses have no global meaning, routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks not using private address space, especially those of Internet service providers, are expected to be configured to reject (filter out) routing information about private networks. If such a router receives such information the rejection shall not be treated as a routing protocol error.

---

The use of the words "should" and "shall" seems to imply that it is possible if one wanted to. Do I have this completely wrong, or have I misundestood what you were saying?

a default routing setup will route regardless of network and host address; the rfc indicates that the reserved blocks _should_ not be routed in public networks; and are in most cases implemented as such on the public routers on the Internet.

the traceroute output in the original post indicates that the 10 dot network host is within a local context to the two adjacent hosts listed.

aside from that, in this example we are not routing _to_ the 10.x.x.x network - we are routing through the 10.x.x.x network as a private infrastructure; because this host/network is local (physical) on both ends to public address space, the IP is irrelevant other than being associated with a mac address in the arp tables of the two adjacent hosts listed.

The addresse used in the private range can be routed on an internal private network. Where I work we use 10.x.x.x for all of our sites. We have 42 remote sites connected to us on a private WAN. All sites use a different subnet of addresses and our main router routes traffic between all sites. When someone accesses the internet then our firewall NAT's it to a routable Internet address assigned to us by our ISP. I can ping any machine at any facility and I remotely connect to their servers all the time.

The reason that the traceroute shows a non routable address is probably because the router is not routing properly or it is misconfigred. The router is just sending back the ICMP packets that it is programmed to send. Also the router may not have a route back to the sender on the interface that it received the packets from. So the router will report back the interface that does have a route back to the sender which in this case it looks like an internal interface on a privately addressed network. Remember that TCP/IP was not designed to use traceroute, it is a hack that was designed to help with network troubleshooting. It is not accurate and you can get back bad information.