10

Today while trying out with networks I took traceroute of 1.1.1.1 and found my gateway address. Whereas I pinged 1.1.1.1 it results with packet loss. I googled about 1.1.1.1 and can't find any relevant results.

The following were my questions:

What is 1.1.1.1? As per my understanding, Default Gateway is used when the host doesn't have any route information for a particular packet. So it will ask the default gateway. Since while tracerouteing is it my default gateway?

i tried to send ack packets using nmap and the result was : enter image description here

Why does 1.1.1.1 respond to traceroute but not respond to ping?

11

1.1.1.1 is contained in APNIC-LABS (1.1.1.0/24), a research network of APNIC Labs. It is reachable (with ping and the like) only when a test is performed. That doesn’t mean, however, that there’s no route to it. It’s a regular IP address, after all.

Traceroute is very different from ping. Only in the last step will it actually contact the destination (1.1.1.1 in your case).

Traceroute, by default, sends a sequence of User Datagram Protocol (UDP) packets addressed to a destination host; ICMP Echo Request or TCP SYN packets can also be used. The time-to-live (TTL) value, also known as hop limit, is used in determining the intermediate routers being traversed towards the destination. Routers decrement TTL values of packets by one when routing and discard packets whose TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded.

I don’t exactly understand your default gateway trouble, though. Any IP traffic leaving a host is directed at the next hop as indicated by the routing table. If there’s a fallback entry, the so-called default gateway, traffic not matching any other rule is directed there.

@bertieb Raises a good point, though: Some ISP-side data compression proxies also use this address illegally.

  • 1
    Because it is down? :D Like I said: It will only be reachable (well, technically speaking: may be reachable) when APNIC is performing a test. Otherwise, it will most definitely not be reachable. – Daniel B Sep 9 '15 at 11:53
7

What is 1.1.1.1?

1.1.1.1 is a public, assigned IP address; which is why you can traceroute to it. It was assigned to APNIC in 2010 (with the rest of the 1.0.0.0/8 block), and pretty useless as many folks treat it as a placeholder.

See Shane Madden's answer over at Server Fault for more info, including the article about traffic linked there.

  • Can I have my DHCP server assign IPs from 1.1.1.1 to 1.1.1.254 to my local network with no problems? – Bruno Finger Mar 2 '16 at 15:40
  • 1
    @BrunoFinger You probably won't run in any problems as the 1.1.1.0/24 prefix is currently assigned to APNIC for research purposes, also given that it is widely abused for local networks (especially the 1.1.1.1 address) and is thus not going to host a publicly-facing service anytime soon. But doing so is definitely bad practice. Practically you can (but shouldn't) use any unicast non-localhost IP range you want for your local network, but then if a public site/service uses the same IP, it won't be reachable from your network. – Ale Feb 20 '18 at 20:57
  • 4
    @Ale And yet, little over a month later, we have a public-facing service on 1.1.1.1. Never assume. Use RFC1918 private addresses, and only those, for a private network. (just reiterating the second half of your comment) – Bob Apr 11 '18 at 0:20
6

1.1.1.1 is used as the default address of the DHCP server on CISCO routers.

However, on the public internet, 1.1.1.1 now belongs to Cloudflare DNS service.

Whois record:

inetnum:        1.1.1.0 - 1.1.1.255
netname:        APNIC-LABS
descr:          APNIC and Cloudflare DNS Resolver project
descr:          Routed globally by AS13335/Cloudflare
descr:          Research prefix for APNIC Labs
country:        AU
org:            ORG-ARAD1-AP
admin-c:        AR302-AP
tech-c:         AR302-AP
mnt-by:         APNIC-HM
mnt-routes:     MAINT-AU-APNIC-GM85-AP
mnt-irt:        IRT-APNICRANDNET-AU
status:         ASSIGNED PORTABLE
remarks:        ---------------
remarks:        All Cloudflare abuse reporting can be done via
remarks:        resolver-abuse@cloudflare.com
remarks:        ---------------
last-modified:  2018-03-30T01:51:28Z
source:         APNIC
  • And 1.0.0.1 / 24 – Ring Ø Apr 9 '18 at 8:04
4

As stated by Daniel B in his answer, the 1.1.1.1 address is currently assigned to APNIC labs (as it was when the question has been asked). However, until January 2010, the 1.0.0.0/8 network block, of which 1.1.1.1 is part, was unassigned and therefore (ab)used for local use in several cases.

Although the network block has been now assigned to APNIC (and addresses starting with 1. are now definitely in use), several old pieces of equipment persist in using 1.1.1.1 for local purposes, and perhaps in consequence of this, a small block of 256 IP addresses (1.1.1.0 to 1.1.1.255) has been reserved for research purposes by APNIC labs.

No route for the 1.1.1.0/24 prefix containing 1.1.1.1 has ever been announced on BGP (see https://stat.ripe.net/1.1.1.1#tabId=at-a-glance for details, in particular 1.1.1.1 was never globally visible as exact match in BGP by any of the RIS peers since beginning of 2004. No less-specific covering prefixes.), which means that the address has never been used for a publicly-facing service. This of course does not mean that this will never happen.

The fact that you can have a traceroute to 1.1.1.1 that responds with the gateway address can come from two sources:

  • The gateway figures out that the address can't be routed because there is no route announcement for it, and therefore answers with an ICMP "unreachable" message -- however your traceroute should in this case display a specific marking (e.g. !H). I would say that this explanation is not very probable, because your gatweay will probably only forward packets to the next router.
  • The 1.1.1.1 address is still used locally by some equipment (see below).

Among unofficial uses of the 1.1.1.1 address, or of an address block containing it:

  • Some equipment from several manufacturers (including Cisco and ZyXel) is still using the 1.1.1.1 address for local purposes (for example, login portals for public WiFi connections, local management networks, etc.). You can perhaps see what the equipment is by going to https://1.1.1.1/ with your browser. Also check the address of your DHCP or DNS server to see if one of those is 1.1.1.1.
  • Fastweb, an Italian ISP (but probably other providers too), was in the past assigning IPs in the 1.0.0.0/8 network to their customers, but since that network range became public, they switched to a more classic private IP range (10.0.0.0/8).

UPDATE (April 11th 2018) — As per Bob's comment to another message, there is now a public DNS service on 1.1.1.1. See also https://1.1.1.1/ for more information about what this is. So this address is now definitely off-limits for private use! (as it should always have been).

$ ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
64 bytes from 1.1.1.1: icmp_req=1 ttl=57 time=4.67 ms
64 bytes from 1.1.1.1: icmp_req=2 ttl=57 time=4.20 ms
64 bytes from 1.1.1.1: icmp_req=3 ttl=57 time=4.19 ms
64 bytes from 1.1.1.1: icmp_req=4 ttl=57 time=4.17 ms
^C
--- 1.1.1.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3030ms
rtt min/avg/max/mdev = 4.179/4.313/4.677/0.210 ms
-1

As of 2019, 1.1.1.1 is a public DNS-Resolver, which according to its provider, Cloudflaire, is:

a fast and private way to browse the Internet. It is a public DNS resolver, but unlike most DNS resolvers, 1.1.1.1 is not selling user data to advertisers. The implementation of 1.1.1.1 makes it the fastest resolver out there.

The result for nmap -sA 1.1.1.1 is as follows:

Starting Nmap 7.60 ( https://nmap.org ) at 2019-05-08 12:13 CEST
Nmap scan report for one.one.one.one (1.1.1.1)
Host is up (0.054s latency).
Not shown: 997 filtered ports
PORT    STATE      SERVICE
53/tcp  unfiltered domain
80/tcp  unfiltered http
443/tcp unfiltered https
  • This appears already in several other answers, and the OP's question dates from 2015, so this is not answering their question anyway... – Ale May 8 at 11:44
  • @Ale it appears only in your answer (which I missed btw) and no, it is not relevant to the original question, but still relevant for those (like me) landing here through search engines. – Yan Foto May 8 at 13:04
  • Ok, I understand your point... (It's not me who voted your answer down, though...) – Ale May 8 at 16:15
  • @Ale thanks for the clarification and your understanding. A down vote is not that dramatic :) I only use down votes for wrong answers, but I don't every random stranger here to stay fair. – Yan Foto May 8 at 20:01

protected by Bob Apr 11 '18 at 0:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.