3 ms·

I'd love to know the story behind the three responses they received from 10.0.0.0/8. I am also curious about this: "With the extracted data more interesting an

by dfc 14y ago

I'd love to know the story behind the three responses they received from 10.0.0.0/8. I am also curious about this: "With the extracted data more interesting analysis can be done,...such as the issue with network and broadcast addresses (.0 and .255)." Why do responses from .0 or .255 have to be an issue? My cable modem sits on a /20. It seems that there are a number of valid ip addresses ending in 0 or 255 in this range: $ ipcalc XX.XX.57.26/255.255.240.0 Address: XX.XX.57.26 XXXXXXXX.XXXXXXXX.XXXX 1001.00011010 Netmask: 255.255.240.0 = 20 11111111.11111111.1111 0000.00000000 Wildcard: 0.0.15.255 00000000.00000000.0000 1111.11111111 Network: XX.XX.48.0/20 XXXXXXXX.XXXXXXXX.XXXX 0000.00000000 HostMin: XX.XX.48.1 XXXXXXXX.XXXXXXXX.XXXX 0000.00000001 HostMax: XX.XX.63.254 XXXXXXXX.XXXXXXXX.XXXX 1111.11111110 Broadcast: XX.XX.63.255 XXXXXXXX.XXXXXXXX.XXXX 1111.11111111 Hosts/Net: 4094 Class A

mkjones 14y ago
I assume the 10.0.0.0/8 responses were from other hosts on their network?
- dfc 14y ago
  You would hope they conducted the test with a machine connected to the internet with a publicly routeable address.
  - bradleyland 14y ago
    They couldn't have done the test otherwise. The significance of 10.0.0.0/8 is that this network is reserved for LAN use.
    - dfc 14y ago
      I'm aware of the signifigance of the netblock, that is why I brought the issue up. Why is it that you think they could not have conducted the test on a machine that is sitting behind a NAT box?
nitrogen 14y ago
I've seen ISPs that use 10.x.x.x addresses internally, so a tracepath from the local network would show an intermediate router with a 10.x.x.x address.
toast0 14y ago
Yes, if you're using ranges larger than /24, addresses ending with 0 and 255 are valid addresses; however, because some people making network equipment are dumb, you will have reduced reachability compared to an address not ending with 0 or 255. Re: responses from 10/8; they may have some connectivity to local 10/8 resources; or it's possible someone was sending them fake ping responses, and the network path they're on doesn't do proper ingress filtering (many don't). Some consumer routers filter traffic to/from addresses ending in .0 or .255 in a naive effort to prevent SMURFing

by dfc 14y ago

mkjones 14y ago

I assume the 10.0.0.0/8 responses were from other hosts on their network?

dfc 14y ago
You would hope they conducted the test with a machine connected to the internet with a publicly routeable address.
- bradleyland 14y ago
  They couldn't have done the test otherwise. The significance of 10.0.0.0/8 is that this network is reserved for LAN use.
  - dfc 14y ago
    I'm aware of the signifigance of the netblock, that is why I brought the issue up. Why is it that you think they could not have conducted the test on a machine that is sitting behind a NAT box?

nitrogen 14y ago

I've seen ISPs that use 10.x.x.x addresses internally, so a tracepath from the local network would show an intermediate router with a 10.x.x.x address.

toast0 14y ago

Yes, if you're using ranges larger than /24, addresses ending with 0 and 255 are valid addresses; however, because some people making network equipment are dumb, you will have reduced reachability compared to an address not ending with 0 or 255. Re: responses from 10/8; they may have some connectivity to local 10/8 resources; or it's possible someone was sending them fake ping responses, and the network path they're on doesn't do proper ingress filtering (many don't). Some consumer routers filter traffic to/from addresses ending in .0 or .255 in a naive effort to prevent SMURFing