30

My home network uses a 192.168.1.0/24 subnet, and when I ping 192.168.1.137 I get a response saying the host is unavailable (as expected because I don't have any machines using that address)

However, when I ping 10.10.10.140 it:

  1. gets a response, and
  2. goes on forever.

I thought 10.0.0.0/8 were all reserved addresses and that any sort of traffic going to those addresses was dropped. What am I pinging when I ping 10.10.10.140? Is it IANA servers?

0
54

I thought 10.0.0.0/8 were all reserved addresses and that any sort of traffic going to those addresses was dropped.

No. It's true that it's a special range, but it's reserved for exactly the same purpose as 192.168.0.0/16 – it is a private address block for LAN usage. (There is also a third block, 172.16.0.0/12. See the IANA registry.)

All three private blocks act as normal unicast addresses and are routable locally, including between each other – they're just not routable across the global Internet. (What's actually dropped is traffic and route announcements between ISPs.)

So most likely you're pinging some host in your ISP's network, where they've decided to use 10.0.0.0/8. It could be a device on their internal network, or a 'management' VLAN on your router itself, or anything.

10
  • 23
    Running traceroute (tracert on Windows) to 10.10.10.140 might fill in some of the details. – Gordon Davisson Sep 30 '19 at 5:54
  • 11
    It could even be another consumer's address (behind the same CGN)! They really should be firewalling that, but a lot of ISPs are amazingly incompetent. – Kevin Sep 30 '19 at 17:21
  • 3
    @Kevin Uhh, why should they firewall one customer from another just because they're both behind CGNAT now? If you can talk to other ISPs' customers, you should be able to talk to the same ISP's customers. – user1686 Oct 1 '19 at 3:54
  • 4
    @grawity - When you talk to other ISPs' customers, it goes through a firewall so that if you're trying Evil Stuff™ with your IP packets, the firewall should block those packets. (The definition of Evil Stuff™ is, of course, situation-dependent). When you're talking to other customers of your ISP, you shouldn't get more access privileges: those conversations should go through a firewall as well. What Kevin seems to be implying is that many ISPs don't put a firewall between two customers behind the same CGN, so any Evil Stuff™ you might try on those connections would work. – rmunn Oct 1 '19 at 11:03
  • 4
    @rmunn: That's fine, but it shouldn't classify regular pings and TCP connections as Evil Stuff™. Even when customers get placed behind a CGNAT, they still have their own firewalls at home to block/allow regular inbound connections – the ISP should have no need to blanket forbid those. – user1686 Oct 1 '19 at 11:05
21

These are three most likely possibilities:

  1. Your ISP assigns its clients the 10.0.0.0/8 addresses. Your home router isn't advanced enough (nor needs to be) to limit routing private blocks upwards.

  2. You have an additional routing device between your router and ISP, like a cable modem, which communicates with your router over 10.0.0.0/8.

  3. You host or access 10.0.0.0/8 network directly at your computer (i.e., a virtual machine network or some VPN).

The most important question is: why do you ping 10.10.10.140 specifically? Also, trying to access popular management services (HTTP, HTTPS, SSH, and Telnet) might reveal device identity and purpose.

2

You potentially could have a device on the network using that IP address that you are not aware of. The 10/8 range is not routable over the internet. I would take a look at your routes and see where its going.

3
  • 4
    It's not routable over the internet, but it is routable over any private network which acknowledges its existence. It is possible that Ryan's ISP is using such a private network (CGNAT - Carrier Grade NAT), and that Ryan's router's external IP is the carrier's private 10/8 network. – Stobor Oct 1 '19 at 4:25
  • 1
    Yeah that's accurate. I didn't consider that originally so I edited my answer to match. – ayao1337 Oct 2 '19 at 15:28
  • Even then, a connection between any two consumers should function identically, regardless of whether they share an ISP or not. – Weckar E. Oct 2 '19 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.