private address in traceroute results

Question

I SSH into a remote host 194.199.68.165 and then use traceroute to check paths to 132.227.62.122 , and I notice that there are some private IPs, like 10.230.10.1

    bash-4.0# traceroute -T 132.227.62.122
    traceroute to 132.227.62.122 (132.227.62.122), 30 hops max, 60 byte packets 
     1  194.199.68.161 (194.199.68.161)  1.103 ms  1.107 ms  1.097 ms
     2  sw-ptu.univ.run (10.230.10.1)  1.535 ms  1.625 ms  2.172 ms
     3  sw-univ-gazelle.univ.run (10.10.20.1)  6.891 ms  6.937 ms  6.927 ms
     4  10.10.5.6 (10.10.5.6)  1.544 ms  1.517 ms  1.518 ms
     5  194.167.142.22 (194.167.142.22)  2.993 ms  2.985 ms  2.976 ms

why there are private addresses near the host?

what are the purposes that these private addresses are used? I mean why they want to put the public IP behind private IPs?

thanks!

Solution 1

it seems like you are having a bit of a hard time getting what Frank Thomas is saying.

Assuming you are at host A. If you want to get to host D you need to go through both routers B and C. B and C, both have interfaces on the public network (155.10.30.1 and 132.277.62.1 respectively). However, their internal routing network is allocated by private space. That is, to route from B to C you have to go over a private network. If you were to traceroute from A to D you would see something like this:

traceroute to 132.227.62.122 (132.227.62.122), 30 hops max, 60 byte packets 
 1  155.10.30.1 1.103 ms  1.107 ms  1.097 ms
 2  10.10.10.2  1.535 ms  1.625 ms  2.172 ms
 3  132.277.62.122  6.891 ms  6.937 ms  6.927 ms

Please note the times are irrelevant for this example.

So even though both sides of the network are public, router B has a route to D via C. Now, please understand - in the real world B probably also has a route which goes to the Internet. However, in this case D's network had a better route (or in the technical parlance - a lower metric) on B via C. Therefore, you see the private network.

Why this happens depends on the specific network. I will hazard a guess. You seem to be on a University network. I say this based on the fact that your internal IP addresses had a DNS entry. Which have a univ in them. If this is indeed the case, you are now routing within a University - or intra-University. As a result, the best route from one University to another may in fact be an internal route instead of going out over the Internet. They may have a circuit that they ran themselves, or they might be using MPLS or Frame Relay to create a private circuit.

Hope that helps.

Solution 2

Tracert works by sending packets addressed to the target host, but with a TTL set to the next expected hop count (eg its first packest are TTL=0, then TTL=1, etc). when TTL=0, the first router will return a ICMP TTL Exceeded message to the host using its own IP as sender, and drop the packet. That TTL Exceeded message is what tracert pays attention to when listing results.

So, if around hop 9, (the initial TTL=10), and the next hop toward the destination is through an internal network (10.230.10.0/24) the router for that network notices that time to live is expired, and responds once again by sending an ICMP TTL Exceeded message to the host, using the sender IP 10.230.10.1. Remember, both sides of a NAT router have a hop between them, so NAT networks do appear. Without knowing more about your specific circumstance, I cant tell you more, but ISPs and large organizations like universities use many many private networks internally.

By using this method, you can observe a path moving through private networks without actually being able to send to or receive directly from them.

More info here.

Comments

[misteryes]

but why the public IP is behind the private IP?

[Frank Thomas]

because ISPs have huge networks, and if they didn;t use private IPs internally, we would have run out of them decades ago. as you move through the ISP inter-network, you are jumping from router to router, and each of those should be included in your trace. you have to exit your ISPs network, pass onto another ISPs network, through it, and eventually on to the destination. you will probably have more private hops than public ones in most cases. from your perspective they are 'behind' but from their perspective, the public address is 'in front'. leave one network, and enter another.

[misteryes]

I thought private IPs are usually used for NATed home network, or LAN inside organizations/companies, and they are behind a public IP. you meant there are routers with private IP addresses? are there many routers with private IP addresses? is it common? are there any articles about this?

[Frank Thomas]

how would you subnet a 10.0.0.0 network without routers that could route between 10.1.0.0/16 and 10.2.0.0/16 ? you are inside someones network. the gateways in and out of their network use public IPs but the routers inside it likely use private addresses. why would a school campus pay for public IPs when they can use as many privates as they want for free? your traceroute is tracing the communication from end to end, even when you are inside someones (and ISPs) private network.