11

I SSH into a remote host 194.199.68.165 and then use traceroute to check paths to 132.227.62.122 , and I notice that there are some private IPs, like 10.230.10.1

    bash-4.0# traceroute -T 132.227.62.122
    traceroute to 132.227.62.122 (132.227.62.122), 30 hops max, 60 byte packets 
     1  194.199.68.161 (194.199.68.161)  1.103 ms  1.107 ms  1.097 ms
     2  sw-ptu.univ.run (10.230.10.1)  1.535 ms  1.625 ms  2.172 ms
     3  sw-univ-gazelle.univ.run (10.10.20.1)  6.891 ms  6.937 ms  6.927 ms
     4  10.10.5.6 (10.10.5.6)  1.544 ms  1.517 ms  1.518 ms
     5  194.167.142.22 (194.167.142.22)  2.993 ms  2.985 ms  2.976 ms

why there are private addresses near the host?

what are the purposes that these private addresses are used? I mean why they want to put the public IP behind private IPs?

thanks!

Improve this question

2 Answers 2

Reset to default
13

it seems like you are having a bit of a hard time getting what Frank Thomas is saying.

Simple Network

Assuming you are at host A. If you want to get to host D you need to go through both routers B and C. B and C, both have interfaces on the public network (155.10.30.1 and 132.277.62.1 respectively). However, their internal routing network is allocated by private space. That is, to route from B to C you have to go over a private network. If you were to traceroute from A to D you would see something like this:

traceroute to 132.227.62.122 (132.227.62.122), 30 hops max, 60 byte packets 
 1  155.10.30.1 1.103 ms  1.107 ms  1.097 ms
 2  10.10.10.2  1.535 ms  1.625 ms  2.172 ms
 3  132.277.62.122  6.891 ms  6.937 ms  6.927 ms

Please note the times are irrelevant for this example.

So even though both sides of the network are public, router B has a route to D via C. Now, please understand - in the real world B probably also has a route which goes to the Internet. However, in this case D's network had a better route (or in the technical parlance - a lower metric) on B via C. Therefore, you see the private network.

Why this happens depends on the specific network. I will hazard a guess. You seem to be on a University network. I say this based on the fact that your internal IP addresses had a DNS entry. Which have a univ in them. If this is indeed the case, you are now routing within a University - or intra-University. As a result, the best route from one University to another may in fact be an internal route instead of going out over the Internet. They may have a circuit that they ran themselves, or they might be using MPLS or Frame Relay to create a private circuit.

Hope that helps.

Improve this answer
6

Tracert works by sending packets addressed to the target host, but with a TTL set to the next expected hop count (eg its first packest are TTL=0, then TTL=1, etc). when TTL=0, the first router will return a ICMP TTL Exceeded message to the host using its own IP as sender, and drop the packet. That TTL Exceeded message is what tracert pays attention to when listing results.

So, if around hop 9, (the initial TTL=10), and the next hop toward the destination is through an internal network (10.230.10.0/24) the router for that network notices that time to live is expired, and responds once again by sending an ICMP TTL Exceeded message to the host, using the sender IP 10.230.10.1. Remember, both sides of a NAT router have a hop between them, so NAT networks do appear. Without knowing more about your specific circumstance, I cant tell you more, but ISPs and large organizations like universities use many many private networks internally.

By using this method, you can observe a path moving through private networks without actually being able to send to or receive directly from them.

More info here.

Improve this answer
5
  • but why the public IP is behind the private IP?
    – misteryes
    Jun 25, 2013 at 14:41
  • 1
    because ISPs have huge networks, and if they didn;t use private IPs internally, we would have run out of them decades ago. as you move through the ISP inter-network, you are jumping from router to router, and each of those should be included in your trace. you have to exit your ISPs network, pass onto another ISPs network, through it, and eventually on to the destination. you will probably have more private hops than public ones in most cases. from your perspective they are 'behind' but from their perspective, the public address is 'in front'. leave one network, and enter another.
    – Frank Thomas
    Jun 25, 2013 at 16:53
  • I thought private IPs are usually used for NATed home network, or LAN inside organizations/companies, and they are behind a public IP. you meant there are routers with private IP addresses? are there many routers with private IP addresses? is it common? are there any articles about this?
    – misteryes
    Jun 25, 2013 at 19:41
  • how would you subnet a 10.0.0.0 network without routers that could route between 10.1.0.0/16 and 10.2.0.0/16 ? you are inside someones network. the gateways in and out of their network use public IPs but the routers inside it likely use private addresses. why would a school campus pay for public IPs when they can use as many privates as they want for free? your traceroute is tracing the communication from end to end, even when you are inside someones (and ISPs) private network.
    – Frank Thomas
    Jun 25, 2013 at 20:09
  • maybe my description is a bit vague. I have updated it. The remote host is with a public IP, not a private IP. And the first hop from is is also a public IP. Then the second and third hops are with private IPs.
    – misteryes
    Jun 25, 2013 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .