Network IP Identification

Spilly · Mar 31, 2011

Ok guys, this has been driving me nuts. I posted a while back trying to track down some packet loss. I got the cable company to fix a few things. However now I am loosing packets to an IP address that is in between me and my ISP. The address is in an internal, 192.168.x.x, address but it is not on my network.

I bypassed my entire network by connecting a machine directly to the cable modem and the address still showed up in a tracert command. The cable company says they don't know what it is and it's not there's. The address is the second hop with everything on my end bypassed.

Any ideas?

k1pp3r · Mar 31, 2011

Is it 192.168.100.1 by any chance?

Spilly · Mar 31, 2011

The actual ip is 192.168.50.1

Brak710 · Mar 31, 2011

On comcast my network looked like this:

Comcast (Public IP) --> Cable Modem (192.166.100.1) --> Router (10.0.0.1)

Your modem may be 192.168.50.1

When you plugged your computer directly into the modem, what was the Default Gateway?

k1pp3r · Mar 31, 2011

192.168.50.1 is normally the default for Dlink i think. Do you have any dlink items on your network

Spilly · Mar 31, 2011

Brak710 said:
On comcast my network looked like this:

Comcast (Public IP) --> Cable Modem (192.166.100.1) --> Router (10.0.0.1)

Your modem may be 192.168.50.1

When you plugged your computer directly into the modem, what was the Default Gateway?

I didn't think to look at the default gateway. I will be back in the office tomorrow and will take a look at it.

I don't believe it was anything in my office. I was seeing a 7ms latency to the first and second hop. Pinging our in house equipment gives a <1ms latency.

k1pp3r said:
192.168.50.1 is normally the default for Dlink i think. Do you have any dlink items on your network

As I said in the OP I bypassed all of my networking equipment and connected a laptop directly to the cable modem.

But no we do not use Dlink. Only Cisco in my office.

k1pp3r · Mar 31, 2011

Post your traceroute please, that may help us

Spilly · Mar 31, 2011

k1pp3r said:
Post your traceroute please, that may help us

C:\Users\>tracert google.com

This was connecting a laptop directly to the Motorola Surfboard.

Tracing route to google.com [74.125.47.103]
over a maximum of 30 hops:

1 8 ms 7 ms 7 ms 10.6.112.1
2 8 ms 8 ms 8 ms 192.168.50.1
3 9 ms 6 ms 21 ms DTR02SPBGSC-VLAN-706.spbg.sc.charter.com [96.34.
64.193]
4 9 ms 9 ms 17 ms crr02spbgsc-tge-0-1-0-7.spbg.sc.charter.com [96.
34.64.55]
5 8 ms 13 ms 15 ms bbr02spbgsc-tge-0-1-0-0.spbg.sc.charter.com [96.
34.2.54]
6 8 ms 8 ms 8 ms bbr01spbgsc-tge-0-0-0-2.spbg.sc.charter.com [96.
34.0.42]
7 20 ms 21 ms 22 ms bbr02sghlga-tge-0-0-0-4.sghl.ga.charter.com [96.
34.0.40]
8 14 ms 15 ms 15 ms prr02atlnga-0-1-0-1.atln.ga.charter.com [96.34.3
.135]
9 15 ms 14 ms 13 ms 96-34-150-30.static.unas.mo.charter.com [96.34.1
50.30]
10 28 ms 38 ms 14 ms 72.14.233.56
11 15 ms 15 ms 15 ms 209.85.254.241
12 37 ms 16 ms 15 ms 209.85.253.161
13 16 ms 15 ms 15 ms yw-in-f103.1e100.net [74.125.47.103]

Trace complete.

Spooony · Apr 1, 2011

please do the following

Go to cmd prompt

Ipconfig /all

Copy and paste it here. Please just remove or make xxx over your mac address.

Then do the following as well and copy and paste it here
Route print

Spilly · Apr 1, 2011

Here is the ipconfig /all with a machine connected directly to the cable modem.

C:\Users\>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . :
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8102E/RTL8103E Family PCI-E Fa
st Ethernet NIC (NDIS 6.20)
Physical Address. . . . . . . . . :mac
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::bd3e:d985:7d4a:1d2b%12(Preferred)
IPv4 Address. . . . . . . . . . . : 24.31.1.57(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, April 01, 2011 9:48:35 AM
Lease Expires . . . . . . . . . . : Friday, April 01, 2011 9:48:35 PM
Default Gateway . . . . . . . . . : 24.31.1.1
DHCP Server . . . . . . . . . . . : 209.55.0.135
DHCPv6 IAID . . . . . . . . . . . : 285222434
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-E7-8D-EB-00-26-22-A1-31-A3

DNS Servers . . . . . . . . . . . : 209.55.5.10
209.55.5.11
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR5009 802.11a/g/n WiFi Adapter
Physical Address. . . . . . . . . : mac
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{C47DF4AE-E257-42B5-8C22-06893C2E15A6}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:142e:2cd8:e7e0:fec6(Pref
erred)
Link-local IPv6 Address . . . . . : fe80::142e:2cd8:e7e0:fec6%13(Preferred)
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter 6TO4 Adapter:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2002:181f:139::181f:139(Preferred)
Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
DNS Servers . . . . . . . . . . . : 209.55.5.10
209.55.5.11
NetBIOS over Tcpip. . . . . . . . : Disabled

Spilly · Apr 1, 2011

C:\Users\>route print
===========================================================================
Interface List
12...00 26 22 a1 31 a3 ......Realtek RTL8102E/RTL8103E Family PCI-E Fast Ether
et NIC (NDIS 6.20)
11...70 1a 04 0e d7 e3 ......Atheros AR5009 802.11a/g/n WiFi Adapter
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
15...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 24.31.1.1 24.31.1.57 20
24.31.1.0 255.255.255.0 On-link 24.31.1.57 276
24.31.1.57 255.255.255.255 On-link 24.31.1.57 276
24.31.1.255 255.255.255.255 On-link 24.31.1.57 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 24.31.1.57 30
169.254.255.255 255.255.255.255 On-link 24.31.1.57 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 24.31.1.57 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 24.31.1.57 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
15 1125 ::/0 2002:c058:6301::c058:6301
1 306 ::1/128 On-link
13 58 2001::/32 On-link
13 306 2001:0:4137:9e76:c87:39fb:e7e0:fec6/128
On-link
15 1025 2002::/16 On-link
15 281 2002:181f:139::181f:139/128
On-link
12 276 fe80::/64 On-link
13 306 fe80::/64 On-link
13 306 fe80::c87:39fb:e7e0:fec6/128
On-link
12 276 fe80::bd3e:d985:7d4a:1d2b/128
On-link
1 306 ff00::/8 On-link
13 306 ff00::/8 On-link
12 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

If I understand the purpose of the Motorola Surfboard, it kind of acts like a switch and doesn't have an IP address and does not assign them. So the first hop should not be the surfboard but should be something outside of our office right?

I had a friend of mine, with a lot more networking experience, take a look at it and he couldn't figure out what the heck was going on.

ghost6303 · Apr 1, 2011

im not sure if this is the default config, or if this guy set it like that, but in this post his cisco router was using the 192.168.50.1 IP.

if you go to command prompt and do

Code:

arp -a 192.168.50.1

it should tell you the MAC address. then you can plug that number into here and it will narrow down the vendor of the equipment atleast.

Spilly · Apr 1, 2011

No arp entries found... The default for cisco is the same as linksys 192.168.1.1

Brak710 · Apr 1, 2011

What's 10.6.112.1, the Surfboard or a Cisco router?

Also, what model is the Surfboard? I'm thinking you have one that also can act like a true gateway/router.

Mister Natural · Apr 1, 2011

Maybe an old network printer port left lingering on the system? Run regedit and do a search for that IP address. See if it pulls up anything.

Spilly · Apr 1, 2011

Brak710 said:
What's 10.6.112.1, the Surfboard or a Cisco router?

Also, what model is the Surfboard? I'm thinking you have one that also can act like a true gateway/router.

I'm pretty confident that the surfboard is not 10.6.112.1 seeing as the latency to that IP is 7ms or greater. The cisco router was not connected to the machine or the surfboard. Logged into the cable modem and it does have DHCP enabled. This the log.

2011-04-01 13:07:43 3-Critical R005.0 Started Unicast Maintenance Ranging - No Response received - T3 time-out
2011-03-31 01:27:30 5-Warning D103.0 DHCP RENEW WARNING - Field invalid in response
2011-03-31 00:12:54 3-Critical R005.0 Started Unicast Maintenance Ranging - No Response received - T3 time-out
2011-03-30 02:18:37 3-Critical T002.0 SYNC Timing Synchronization failure - Failed to acquire FEC framing
2011-03-30 01:10:20 3-Critical R005.0 Started Unicast Maintenance Ranging - No Response received - T3 time-out
2011-03-27 13:27:29 5-Warning D103.0 DHCP RENEW WARNING - Field invalid in response
2011-03-27 13:26:47 3-Critical R005.0 Started Unicast Maintenance Ranging - No Response received - T3 time-out
2011-03-24 00:27:09 5-Warning D103.0 DHCP RENEW WARNING - Field invalid in response

Mister Natural said:
Maybe an old network printer port left lingering on the system? Run regedit and do a search for that IP address. See if it pulls up anything.

All print servers here (Dlink D301's) have a default IP of 192.168.0.10 and we have not used the 192.168.50.x on any other equipment/network. Our two other offices, connected over VPN, use 192.168.1.x and 192.168.20.x

I also didn't add that we did not see that IP when we were running a T1 line on the same network. I would test this again but ATT finally disconnected it yesterday. That IP is also not pingable when disconnecting the surfboard from our cisco router. We just recently switched to cable, (until the County Board approves our fiber) to get out of an auto-renewal, and that IP is there on any tracert to any where outside of our office.

Update: Playing around with Cain and description it gives is "NAC RADB TESTING" for 10.6.112.1

Brak710 · Apr 1, 2011

Does http://192.168.50.1 or https://192.168.50.1 bring up anything?

Maybe run nmap or some other scanner to see if it can identify what type of device it is, at least.

Spilly · Apr 1, 2011

Brak710 said:
Does http://192.168.50.1 or https://192.168.50.1 bring up anything?

Maybe run nmap or some other scanner to see if it can identify what type of device it is, at least.

Seeing "Error 102 (net::ERR_CONNECTION_REFUSED): Unknown error." with https:192.168.50.1

Will try nmap

x.sci · Apr 1, 2011

Spilly said:
If I understand the purpose of the Motorola Surfboard, it kind of acts like a switch and doesn't have an IP address and does not assign them. So the first hop should not be the surfboard but should be something outside of our office right

Cable modem always gets an IP address and usually it's from a private range. It usually then acts as some sort of bridge between lan and cmts.

I'd say those 10/192 ips are modem/cmts but that shouldn't really matter to you (and most help desk clerks are clueless about actual networks btw). Just keep calling support until you get someone with a clue to help you fix your packet loss.

Edit: Forgot to mention, lots of new cable modems now can act as routers also. But it's like having a plain modem and then router connected to it, just rolled into a single device.

Spilly · Apr 1, 2011

x.sci said:
Cable modem always gets an IP address and usually it's from a private range. It usually then acts as some sort of bridge between lan and cmts.

I'd say those 10/192 ips are modem/cmts but that shouldn't really matter to you (and most help desk clerks are clueless about actual networks btw). Just keep calling support until you get someone with a clue to help you fix your packet loss.

Edit: Forgot to mention, lots of new cable modems now can act as routers also. But it's like having a plain modem and then router connected to it, just rolled into a single device.

Supposedly I was speaking with their "network engineer"

Update: 192.168.50.1 is absolutely positively my ISP's equipment. After scanning it for open ports, I found one and entered the address into the web browser. This prompted a download. Opened the download with notepad and it reads:

This systems is restricted to use by employees of |
| NCC only. Any unauthorized access |
| or use of this system will be punished to full extent |
| under the law. Use of this system is monitored. By |
| using this system, you are automatically consenting to |
| such monitoring. Should this monitoring reveal criminal|
| activities, you will be reported to the appropriate |
| authorities. If you have arrived at this message in |
| error, please log out now!

Whoops....

Innocence · Apr 1, 2011

So plugged directly into the Modem, you're getting an external Class A - 24.31.1.57
with a Default Gateway of : 24.31.1.1

But when you do a tracert to an external address, for some reason the first hop is hitting an Internal address 10.6.112.1, then another Internal - 192.168.50.1 ?

That just straight up blows my damn mind. Could you confirm this is what's actually happening on the same machine plugged in the same way?

x.sci · Apr 1, 2011

Well, worst case, nmapping cmts might net you a clueful isp contact

Spilly · Apr 1, 2011

Update: 192.168.50.1 is absolutely positively my ISP's equipment. After scanning it for open ports, I found one and entered the address into the web browser. This prompted a download. Opened the download with notepad and it reads:

This systems is restricted to use by employees of |
| NCC only. Any unauthorized access |
| or use of this system will be punished to full extent |
| under the law. Use of this system is monitored. By |
| using this system, you are automatically consenting to |
| such monitoring. Should this monitoring reveal criminal|
| activities, you will be reported to the appropriate |
| authorities. If you have arrived at this message in |
| error, please log out now!

Whoops

Spilly · Apr 1, 2011

Innocence said:
So plugged directly into the Modem, you're getting an external Class A - 24.31.1.57
with a Default Gateway of : 24.31.1.1

But when you do a tracert to an external address, for some reason the first hop is hitting an Internal address 10.6.112.1, then another Internal - 192.168.50.1 ?

That just straight up blows my damn mind. Could you confirm this is what's actually happening on the same machine plugged in the same way?

I don't follow on what you would like for me to do.

Innocence · Apr 1, 2011

Spilly said:
I don't follow on what you would like for me to do.

Run an ipconfig and tracert back to back on the same machine hooked up directly to your modem with no other live connections (WiFi, etc).

It just don't make any sense to me that you're not seeming to route out your gateway, but instead some totally unrelated IP.

Spilly · Apr 4, 2011

Innocence said:
Run an ipconfig and tracert back to back on the same machine hooked up directly to your modem with no other live connections (WiFi, etc).

It just don't make any sense to me that you're not seeming to route out your gateway, but instead some totally unrelated IP.

Exact same results.

Deleted member 214115 · Apr 4, 2011

This is normal. IP addresses are very limited and the networks that are created for use within the first one to two hops (or even more) in the rout will most likely be RFC 1597. One of them can even be a DPI (Deep packet Inspection) device or firewall.

mattjw916 · Apr 4, 2011

Shikami said:
This is normal. IP addresses are very limited and the networks that are created for use within the first one to two hops (or even more) in the rout will most likely be RFC 1597. One of them can even be a DPI (Deep packet Inspection) device or firewall.

RFC1918...

Deleted member 214115 · Apr 4, 2011

RFC1918

Yes, correct! The updated version. 1597, and 1627 are obsolete.

x.sci · Apr 4, 2011

Shikami said:
This is normal. IP addresses are very limited and the networks that are created for use within the first one to two hops (or even more) in the rout will most likely be RFC 1597. One of them can even be a DPI (Deep packet Inspection) device or firewall.

This is "normal" for wireless networks, where you don't even get a public ip or perhaps outside western world.

It's normal for cable modems to have a private ip for management like spilly's seeing here but in practically every installation i've dealt with that's hidden from end user (traceroutes don't see those private ips). And it should be.

Spilly · Apr 4, 2011

x.sci said:
This is "normal" for wireless networks, where you don't even get a public ip or perhaps outside western world.

It's normal for cable modems to have a private ip for management like spilly's seeing here but in practically every installation i've dealt with that's hidden from end user (traceroutes don't see those private ips). And it should be.

So the IP that is in question will be a router inside my ISP's office?

x.sci · Apr 4, 2011

Yup. It's probably a misconfiguration on isp's part that you can see them (or you should hope so

Thinking about it, when was the last time you restarted your modem? It should refetch it's configuration on boot, so you might try power cycling it and see if that fixes the problem.

Spilly · Apr 4, 2011

That certainly does not give me a lot of confidence in my ISP. I wonder what other security flaws there are...

Deleted member 214115 · Apr 4, 2011

So the IP that is in question will be a router inside my ISP's office?

No, this is along the route to the destination address on the second hop, actually.

Network IP Identification

Limp Gawd

[H]F Junkie

Limp Gawd

[H]ard|Gawd

[H]F Junkie

Limp Gawd

[H]F Junkie

Limp Gawd

2[H]4U

Limp Gawd

Limp Gawd

2[H]4U

Limp Gawd

[H]ard|Gawd

2[H]4U

Limp Gawd

[H]ard|Gawd

Limp Gawd

Weaksauce

Limp Gawd

2[H]4U

Weaksauce

Limp Gawd

Limp Gawd

2[H]4U

Limp Gawd

Deleted member 214115

Guest

[H]ard|Gawd

Deleted member 214115

Guest

Weaksauce

Limp Gawd

Weaksauce

Limp Gawd

Deleted member 214115

Guest