Paranoia-based question...

[lowlevel]

I've noticed this evening that my cable service has been sluggish, and had tried pinging some national sites with mixed results... about 50/50 timeouts to responses. So, I tried trace-routing one of the timeouts and got a somewhat strange result.

The first IP listed was my router, but the second was an address from outside my service provider's usual IP block: 10.65.88.1

An IP whois lookup yeilded this result:

Query : 10.65.88.1
(Non-existent host/domain)



(0.000)
--------------------------------------------------------------------------------Query 'NetGeo - The Internet Geographic Database' for 10.65.88.1

NetGeo Results:
VERSION=1.0

TARGET: 10.65.88.1
NAME: RESERVED-10
NUMBER: 10.0.0.0 - 10.255.255.255
CITY: MARINA DEL REY
STATE: CALIFORNIA
COUNTRY: US
LAT: 33.98
LONG: -118.45
LAT_LONG_GRAN: City
LAST_UPDATED: 16-May-2001
NIC: ARIN
LOOKUP_TYPE: Block Allocation
RATING:
DOMAIN_GUESS: iana.org
STATUS: OK


(0.345)--------------------------------------------------------------------------------Whois query by IP address allocation:

'whois -h whois.arin.net 10.65.88.1'


OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 10.0.0.0 - 10.255.255.255
CIDR: 10.0.0.0/8
NetName: RESERVED-10
NetHandle: NET-10-0-0-0-1
Parent:
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment:
RegDate:
Updated: 2002-09-12

OrgTechHandle: IANA-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-823-9358
OrgTechEmail: res-ip@iana.org

# ARIN WHOIS database, last updated 2003-03-29 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.


(0.612)
(2.982 total)--------------------------------------------------------------------------------Query number: 234,267
(Ver, Mar 26 2003 - 22:25:29)

After that second IP address, the traceroute resumes with IP's from my service provider's normal IP block. I've preformed trace-routes before with this same local network setup, and NEVER came across that second IP before.

I visited the iana.org website, but I really don't see any sort of explanation.

Thoughts or enlightenment, anyone?

 

[randal]

The 10.x.x.x subnet is what's known as a "reserved" network. No one particular entity owns 10.x.x.x, but *TONS* of companies use them for internal routing, as they are generally not accessible from the net at large. The 10.x.x.x network is analagous to the 192.168.x.x, which you might be familiar with, but just a lot bigger (more IP addresses available).

We use a 10.x.x.x network for our internal devices, such as routers, wireless subscriber units, etc. These devices are not internet-at-large accessible, but are accessible from our internal network. Our customers have real internet IP addresses that get routed through these devices, resulting in a traceroute that lists the 10.x.x.x IP addresses.

Honestly, I would be a little miffed if your ISP *didn't* use some reserved network for their internal devices. I definitely wouldn't be worried about seeing a 10.x.x.x IP on one of the first couple of hops in a traceroute.

Cheers,
randal

 

[lowlevel]

Ah, I see.

Thanks for the helpful information. I wasn't aware that the 10.xx.xx.xx block was a reserved segment, akin to the 192.168.xxx.xxx.

🙂

 

[Oaf357]

This brings up another interesting point.

I've been seeing news articles and such about bills being put up in Congress that could potentially illiminate NATs and VPNs.

Seeing how this could greatly affect everybody using the Internet and numerous organizations (the US government included) I don't think it's likely but the better question is; where the hell did this idea come from?

 

[JackMDS]

Quote: "Paranoia-based question..."

This might help: "Risperidone" (j/k).

 

[Lord Evermore]

oaf: links? I haven't heard anything about such specifically. It might have been referred to in one of the many other anti-privacy/anti-piracy bills being proposed every day, since if you're using a VPN you're encrypting traffic so the government would have to work harder to read your data, and NAT sort of makes you a little less accessible if they felt like hacking you.

 

[spidey07]

As an aside I'm seeing more and more providers block IP protocol 50 (esp traffic for IPsec VPNs)

Causing lots of headaches over seas.

 

[Fallen Kell]

Link to info about using VPN's, Firewalls, etc.

Also, this box may just be a network website cache (i.e. caches websites that are frequently accessed for all subscribers, thus limiting the need to pull the website info from the internet). These types of boxes are more and more common especially since they both speed up customer's perception of fast service as well as decrease the amount of traffic being sent to the internet (and thus reduce the ISP's costs).