Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I ran into some intermittent Internet connectivity issues the other day at home, I decided to do something I rarely bother with - I plugged my laptop directly into the cable modem to see what was up. Once the connection came back up, I decided to do some diagnostics while I was still directly connected to be sure everything was properly functioning.

During this test:

  • My laptop was plugged directly into the cable modem.
    • As far as I know, this is a "dummy" modem - it's not an all-in-one cable modem/router/wifi device.
  • I had no other devices on the network being tested.
  • My laptop received an IP address and gateway via DHCP, both of which were publicly-routable "Class A" addresses.

If I ran a pathping or tracert to the gateway, everything came back normal - nothing appeared to be in between my laptop and the gateway.

However, when I ran the same utilities against other targets (Google, Yahoo, etc.) on the Internet, the first hop came back in the "Class A" range of RFC 1918 addresses. Also, the publicly-routable Default Gateway address did not show up at all in the traces.

Again, the only devices connected in my house at this point were my laptop and the cable modem. So, presumably the first hop to any address not in my DHCP-assigned subnet should always be whichever address shows up in ipconfig as the "Default Gateway".

Could someone explain how this can happen, and why there might be legitimate reason for it?

share|improve this question
I haven't tried it but that sounds very strange, if out on the internet there's a computer with a private ip, are you sure it's not one of your computers? which would also be a bit strange.. Why not include a dump of output, but change the public ip so it's not recognisable as you. – barlop May 2 '11 at 17:22
@barolp - I might do that sometime. Just not at home (and not inclined to disconnect the rest of my home network) right now to do it. It definitely wasn't "one of my computers", since the only computer networked at the time was my laptop and it was plugged directly to the cable modem. I'll try to clarify in my OP. – Iszi May 2 '11 at 17:38
up vote 3 down vote accepted

tracert works by sending packets which have a short TTL ("time to live") and gather the obituaries which are sent back. Namely, when a packet is sent, is has a numerical TTL, which is decremented by each host through which the packet goes. If the TTL reaches zero, the packet dies. The host in which the packet dies normally sends back a control message (ICMP) to state "the packet died here"; that message contains the address that the said host considers to be his own true address. This is not necessarily the address which you so: a router, by construction, has several addresses.

For instance, if your gateway as public address but also has, within the ISP network, the address, then the ICMP message may perfectly come back tagged with (this address is not "public" but that's mostly a convention, of which the router needs not be aware).

share|improve this answer
Thomas, you have a marvelous way with words - gather the obituaries which are sent back :) – nealmcb May 2 '11 at 19:17

Sometimes providers use the private address space for internal routing. Germany's largest internet provider T-Online even put servers into that address space until the end of 2005.

While using private address space for internal routing does not have a negative impact on reachability, it is generally considered bad practice: It makes tracing down issues using traceroute harder and causes support calls.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.