Security Incidents mailing list archives
Re: Strange traceroute
From: chaser () MEWL NET (Troy Ablan)
Date: Sat, 5 Feb 2000 04:03:50 -0500
AFAIK, routing can happen over an ISP's private network, but it seems like a bad practice. Most ISPs filter inbound packets with private source addresses, so if the route were symmetric, a traceroute from the remote side to your box would encounter lines with all asterisks on the hops where the 10.x.x.x routers would be. -Troy On Thu, 3 Feb 2000, RB wrote:
Hi everyone, thanks a bunch for the answers. I should have given more info though, I was very vague and now I've made myself look incredibly stupid..... Anyway I have a valid (public) IP address. My next hop is my default gateway also another valid public address. Instead of my usual path out of the @home network I saw a private IP pop up and it made me wonder. I was trying to find the break in my connection to my news server which is supplied by another ISP (@home's are woefully lacking). I was able to ping my default gateway and do a traceroute to it (note I have a static IP), doing it that way it is the first hop. But doing a traceroute to any other public address shows the 10.76.x.x address as the first hop. I posted it to this security list because it seemed strange that a private IP address would be displayed. I'm not thinking that I was comprimised or under attack, just a little curious. RB
Current thread:
- Re: massive unapproved AXFR's and odd rcvd NOTIFY's, (continued)
- Re: massive unapproved AXFR's and odd rcvd NOTIFY's Francis A. Vidal (Feb 09)
- [UPDATE]Dos Trojan on Solaris Roderick Padilla (Feb 09)
- Re: [UPDATE]Dos Trojan on Solaris Ross Mueller (Feb 09)
- a very strange scan Boris Badenov (Feb 09)
- Re: a very strange scan Russell Fulton (Feb 10)
- Possible stacheldraht variant/probe Stephen P. Berry (Feb 09)
- Re: Possible stacheldraht variant/probe David Brumley (Feb 10)
- Re: [UPDATE]Dos Trojan on Solaris Robert Lau (Feb 09)
- Re: Strange traceroute Rob Quinn (Feb 08)
- vi as a suid Paulo Ribeiro (Feb 08)
- Re: Strange traceroute Hauke Johannknecht (Feb 08)
- Re: sendmail vunerability ? CyberPsychotic (Feb 07)
- Re: sendmail vunerability ? H D Moore (Feb 10)