North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Strange public traceroutes return private RFC1918 addresses

  • From: Jonas Frey (Probe Networks)
  • Date: Mon Feb 02 18:23:05 2004 
This is quite often used. You cant (d)DoS the routers this way, nor try
to do any harm to them as you cant reach them.

Regards,
Jonas

On Tue, 2004-02-03 at 00:01, Brian (nanog-list) wrote:
> Any ideas how (or why) the following traceroutes are leaking private
> RFC1918 addresses back to me when I do a traceroute?
> 
> Maybe try from your side of the internet and see if you get the same
> types of responses.
> 
> It's really strange to see 10/8's and 192.168/16 addresses coming from
> the public internet.  Has this phenomenon been documented anywhere? 
> Connectivity to the end-sites is fine, it's just the traceroutes that
> are strange.
> 
> (initial few hops sanitized)
> 
> [[email protected] /]# traceroute www.ibm.com
> traceroute: Warning: www.ibm.com has multiple addresses; using
> 129.42.17.99
> traceroute to www.ibm.com (129.42.17.99), 30 hops max, 38 byte packets
>  1  (---.---.---.---)  2.481 ms  2.444 ms  2.379 ms
>  2  (---.---.---.---)  17.964 ms  17.529 ms  17.632 ms
>  3  so-1-2.core1.Chicago1.Level3.net (209.0.225.1)  17.891 ms  17.985
> ms  18.026 ms
>  4  so-11-0.core2.chicago1.level3.net (4.68.112.194)  18.272 ms 
> 18.109 ms  17.795 ms
>  5  so-4-1-0.bbr2.chicago1.level3.net (4.68.112.197)  17.851 ms 
> 17.859 ms  18.094 ms
>  6  so-3-0-0.mp1.stlouis1.level3.net (64.159.0.49)  23.095 ms  22.975
> ms  22.998 ms
>  7  ge-7-1.hsa2.stlouis1.level3.net (64.159.4.130)  23.106 ms  23.237
> ms  22.977 ms
>  8  unknown.level3.net (63.20.48.6)  24.264 ms  24.099 ms  24.154 ms
>  9  10.16.255.10 (10.16.255.10)  24.164 ms  24.108 ms  24.105 ms
> 10  * * *
> 
> 
> [[email protected] /]# traceroute www.att.net
> traceroute: Warning: www.att.net has multiple addresses; using
> 204.127.166.135
> traceroute to www.att.net (204.127.166.135), 30 hops max, 38 byte
> packets
>  1  (---.---.---.---)  2.404 ms  2.576 ms  2.389 ms
>  2  (---.---.---.---)  17.953 ms  18.170 ms  17.435 ms
>  3  500.pos2-1.gw10.chi2.alter.net (63.84.96.9)  18.077 ms *  18.628
> ms
>  4  0.so-6-2-0.xl1.chi2.alter.net (152.63.69.170)  18.238 ms  18.321
> ms  18.213 ms
>  5  0.so-6-1-0.BR6.CHI2.ALTER.NET (152.63.64.49)  18.269 ms  18.396
> ms  18.329 ms
>  6  204.255.169.146 (204.255.169.146)  19.231 ms  19.042 ms  18.982 ms
>  7  tbr2-p012702.cgcil.ip.att.net (12.122.11.209)  20.530 ms  20.542
> ms  23.033 ms
>  8  tbr2-cl7.sl9mo.ip.att.net (12.122.10.46)  26.904 ms  27.378 ms 
> 27.320 ms
>  9  tbr1-cl2.sl9mo.ip.att.net (12.122.9.141)  27.194 ms  27.673 ms 
> 26.677 ms
> 10  gbr1-p10.bgtmo.ip.att.net (12.122.4.69)  26.606 ms  28.026 ms 
> 26.246 ms
> 11  12.122.248.250 (12.122.248.250)  27.296 ms  28.321 ms  28.997 ms
> 12  192.168.254.46 (192.168.254.46)  28.522 ms  30.111 ms  27.439 ms
> 13  * * *
> 14  * * *