Security Incidents mailing list archives

Re: Strange traceroute


From: fygrave () EPR0 ORG (CyberPsychotic)
Date: Sat, 5 Feb 2000 13:50:39 +0500


On Thu, 3 Feb 2000 out of nowhere RB spoke:

~:public address shows the 10.76.x.x address as the first hop. I posted it to
~:this security list because it seemed strange that a private IP address would
~:be displayed. I'm not thinking that I was comprimised or under attack, just
~:a little curious.

 As I mentioned in some of my previous posts, some people use private IP
range IP addresses for point-to-point interfaces on multi-homed nodes.
While it's not entirely correct (some sort of `ip unnumbered e0` is) it
works in most cases and doesn't interfere with anything but traceroute
as long as you don't use the node to establish outgoing connections..

-F


Current thread: