192.168.x.x oddities

From: Jimmy Brokaw (hedgie_at_hedgie.com)
Date: 06/14/04

  • Next message: Ansgar -59cobalt- Wiechers: "Re: Blocking NetBios" 
    Date: Mon, 14 Jun 2004 17:48:57 -0400 (EDT)
To: security-basics@securityfocus.com

    This seems like a stupid question from a non-guru like me, but I've asked
    a couple of the "gurus" I know and gotten nothing but strange looks.

    I run a small network at home, using a wireless router to connect to a
    cable modem. My internal IPs all fall in the 192.168.0.x range, which is
    the only address-space the router is configured to support. I've got
    authentication and logging, so before anyone says "I bet it's a neighbor
    using your connection," I've verified nobody else is logging in.

    My understanding is that the entire 192.168.x.x range is for internal
    networks only (RFC 1918), and unrouteable on the Internet. When I run the
    following command, however, I can see several computers:

    [computer]$ nmap 192.168.*.* -sP

    I get what looks like four computers (in addition to mine), plus some x.0
    and x.255 addresses responding to the pings. I picked one at random, and
    it appears to belong to my ISP. Doing a traceroute, I found the packet
    reached its destination at a public (routeable) address, indicating to me
    the machine has two addresses on the same interface. RFC 1918 states:

       One might be tempted to have both public and private addresses on the
       same physical medium. While this is possible, there are pitfalls to
       such a design (note that the pitfalls have nothing to do with the use
       of private addresses, but are due to the presence of multiple IP
       subnets on a common Data Link subnetwork). We advise caution when
       proceeding in this area.

    Am I therefore correct in my assumption that the ISP is routing my pings
    onto their internal network? Is this a normal response? It seems like
    there ought to be security concerns here, but I can't nail them down,
    except the assumption that traffic destined for 192.168.x.x addresses may
    not be filtered as well (or at all), since it may be assumed it originated
    from within the internal network. 

    -- 
   \\\\\                       hedgie@hedgie.com
  \\\\\\\__o   Bringing hedgehogs to the common folk since 1994.
__\\\\\\\'/________________________________________________________
Visit http://www.hedgie.com for information on my latest book,
"Waiting for War," published by Aventine Press!
---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------
  • Next message: Ansgar -59cobalt- Wiechers: "Re: Blocking NetBios"

    Relevant Pages

    • Re: Intermittent Firewall 15108 Events on SBS2003/ISA2004
      ... This newsgroup only focuses on SBS technical issues. ... of |> the internal network object). ... If the ISA server receives a package with an |> internal IP as source address from the external port, the package would be |> treated as a spoof attack. ... |> 825763 How to configure Internet access in Windows Small Business ...
      (microsoft.public.windows.server.sbs)
    • Re: How to get through iptables/NAT, reality and risk calculation
      ... there have been no security issues with the ... # the external interface, and/or the internal one on all ports but 22 tcp ... # so the firewall itself can't talk to anything but the internal network over ... >> accepting traffic from the internet part of an existing connection (with ...
      (Security-Basics)
    • Re: Hyper-V, RAAS woes. . . Please help
      ... From the host I am able to ping www.news.com. ... Can you ping the host's static public IP from the guest? ... > My Hyper-V Guests cannot traverse through NAT to gain internet access. ... Pointed internet network to the internal network ...
      (microsoft.public.windows.server.general)
    • Re: new to ISA, but not firewalls
      ... the internal network in a direct way, and this is of the things that ISA2004 ... internet and the internal network, however i don't a know why any one would ... Remember if ISA LAT is empty, ... >> include the internal interface IP. ...
      (microsoft.public.isa)
    • Re: new to ISA, but not firewalls
      ... the internal network in a direct way, and this is of the things that ISA2004 ... internet and the internal network, however i don't a know why any one would ... Remember if ISA LAT is empty, ... >> include the internal interface IP. ...
      (microsoft.public.isa.configuration)
    Loading