Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2323 > unrolled thread

What is this?

Back to article view | Back to comp.os.linux.networking

Contents

  What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-25 06:16 +0100
    Re: What is this? "Greg Foster" <fosterg@co.mendocino.ca.us> - 2013-09-25 08:11 -0700
      Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-25 19:08 +0100
        Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-25 19:20 +0100
    Re: What is this? Marc Haber <mh+usenetspam1118@zugschl.us> - 2013-09-25 18:11 +0200
      Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-25 19:12 +0100
        Re: What is this? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-09-25 21:19 +0300
          Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-25 19:27 +0100
            Re: What is this? Marc Haber <mh+usenetspam1118@zugschl.us> - 2013-09-27 07:07 +0200
    Re: What is this? Rick Jones <rick.jones2@hp.com> - 2013-09-25 23:38 +0000
      Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-26 02:36 +0100
        Re: What is this? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-09-26 08:23 +0300
          Re: What is this? Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> - 2013-09-26 15:06 +0100

#2323 — What is this?

Hi,

I have a home local network 192.168.1.xxx.
Recently, sometimes I have the following situation:
Pinging a computer that is off I got some messages like this:

From 10.39.191.254: icmp_seq=2 Packet filtered

This is very rare, but happens.

Does anybody know its meaning?

Thanks for any help.

[toc] | [next] | [standalone]

#2324

[Multipart message — attachments visible in raw view] — view raw

"Filtered" suggests a firewall.  The replying IP does not appear to be on your home network.  Could it be the external IP of your router or internet connection device?

You might also try running a traceroute to see what path is being taken.  Traffic between two local computers should not generate any additional hops in a trace.

It wouldn't hurt to verify the network masks on all participants to make sure they match.

-Greg

>>> Paulo da Silva<p_s_d_a_s_i_l_v_a@netcabo.pt> 9/24/2013 10:16 PM >>>
Hi,

I have a home local network 192.168.1.xxx.
Recently, sometimes I have the following situation:
Pinging a computer that is off I got some messages like this:

From 10.39.191.254: icmp_seq=2 Packet filtered

This is very rare, but happens.

Does anybody know its meaning?

Thanks for any help.

[toc] | [prev] | [next] | [standalone]

#2326

Em 25-09-2013 16:11, Greg Foster escreveu:
> 
....
> Could it be the external IP of your router or
> internet connection device?
> 
I couldn't find this address anywhere! There's only one modem/router
connected to the ISP. There's only one network 192.168.1.xxx.


> You might also try running a traceroute to see what path is being
> taken.
traceroute 10.39.191.254
traceroute to 10.39.191.254 (10.39.191.254), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
...
 30  * * *

# ping 10.39.191.254
PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
^C
--- 10.39.191.254 ping statistics ---
9 packets transmitted, 0 received, 100% packet loss, time 7999ms

Both commands were issued with the firewall deactivated.
traceroute does not work with the firewall activated.


> 
>>>> Paulo da Silva<p_s_d_a_s_i_l_v_a@netcabo.pt> 9/24/2013 10:16 PM >>>
> Hi,
> 
> I have a home local network 192.168.1.xxx.
> Recently, sometimes I have the following situation:
> Pinging a computer that is off I got some messages like this:
> 
> From 10.39.191.254: icmp_seq=2 Packet filtered
> 
> This is very rare, but happens.
> 
> Does anybody know its meaning?
> 
> Thanks for any help.
> 
> 

[toc] | [prev] | [next] | [standalone]

#2329

Em 25-09-2013 19:08, Paulo da Silva escreveu:
> Em 25-09-2013 16:11, Greg Foster escreveu:
>>
> ....
>> Could it be the external IP of your router or
>> internet connection device?
>>
> I couldn't find this address anywhere! There's only one modem/router
> connected to the ISP. There's only one network 192.168.1.xxx.
> 
> 
>> You might also try running a traceroute to see what path is being
>> taken.
> traceroute 10.39.191.254
> traceroute to 10.39.191.254 (10.39.191.254), 30 hops max, 60 byte packets
>  1  * * *
>  2  * * *
> ...
>  30  * * *
> 
> # ping 10.39.191.254
> PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
> ^C
> --- 10.39.191.254 ping statistics ---
> 9 packets transmitted, 0 received, 100% packet loss, time 7999ms
> 
> Both commands were issued with the firewall deactivated.
> traceroute does not work with the firewall activated.
> 

Yet more strange. Right now I got this with the firewal disabled:
ping 10.39.191.254
PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
From 10.39.191.254: icmp_seq=5 Packet filtered
^C
--- 10.39.191.254 ping statistics ---
16 packets transmitted, 0 received, +1 errors, 100% packet loss, time
15000ms

Most of the time this doesn't happen. Only very few times.

[toc] | [prev] | [next] | [standalone]

#2325

Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
>I have a home local network 192.168.1.xxx.
>Recently, sometimes I have the following situation:
>Pinging a computer that is off I got some messages like this:
>
>From 10.39.191.254: icmp_seq=2 Packet filtered

A local computer? By IP or by host name? If host name, to which IP
does the host name resolve when it happens? If IP, are you sure that
you're pinging the right address?

Greetings
Marc
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#2327

Em 25-09-2013 17:11, Marc Haber escreveu:
> Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
>> I have a home local network 192.168.1.xxx.
>> Recently, sometimes I have the following situation:
>> Pinging a computer that is off I got some messages like this:
>>
>>From 10.39.191.254: icmp_seq=2 Packet filtered
> 
> A local computer? By IP or by host name? If host name, to which IP
> does the host name resolve when it happens?
> 
By host name. It is defined in the /etc/hosts file.

[toc] | [prev] | [next] | [standalone]

#2328

On 25.9.13 9:12 , Paulo da Silva wrote:
> Em 25-09-2013 17:11, Marc Haber escreveu:
>> Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
>>> I have a home local network 192.168.1.xxx.
>>> Recently, sometimes I have the following situation:
>>> Pinging a computer that is off I got some messages like this:
>>>
>> >From 10.39.191.254: icmp_seq=2 Packet filtered
>>
>> A local computer? By IP or by host name? If host name, to which IP
>> does the host name resolve when it happens?
>>
> By host name. It is defined in the /etc/hosts file.


The 10.x.y.z address group belongs to RFC1918 private,
locally administered addresses, along with 192.168.u.w
and a certain group of 172.s.t.q addresses.

If you are the local network administrator, you should
know why it is in /etc/hosts.

-- 

Tauno Voipio

[toc] | [prev] | [next] | [standalone]

#2330

Em 25-09-2013 19:19, Tauno Voipio escreveu:

>>> >From 10.39.191.254: icmp_seq=2 Packet filtered
>>>
>>> A local computer? By IP or by host name? If host name, to which IP
>>> does the host name resolve when it happens?
>>>
>> By host name. It is defined in the /etc/hosts file.
> 
> 
> The 10.x.y.z address group belongs to RFC1918 private,
> locally administered addresses, along with 192.168.u.w
> and a certain group of 172.s.t.q addresses.
> 
> If you are the local network administrator, you should
> know why it is in /etc/hosts.
> 
Sorry. What I meant was that that the host name and the IP were int
hosts file but the ip is 192.168.1.22.

Here is the line:
192.168.1.22  deimos.homenet.pt    deimos

[toc] | [prev] | [next] | [standalone]

#2335

Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
>Here is the line:
>192.168.1.22  deimos.homenet.pt    deimos

If that was pasted, it's correct. Please paste ip addr and ip route's
output as well.

Greetings
Marc
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#2331

Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:

> I have a home local network 192.168.1.xxx.
> Recently, sometimes I have the following situation:
> Pinging a computer that is off I got some messages like this:

> From 10.39.191.254: icmp_seq=2 Packet filtered

> This is very rare, but happens.

> Does anybody know its meaning?

Your local home network - is it wired or wireless?  Is it connected
via a home "router" to an ISP?  If so, what is the IP address the ISP
assigned to the home router (the ISP/"WAN" side, not your local
network side).

rick jones
-- 
Process shall set you free from the need for rational thought. 
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

[toc] | [prev] | [next] | [standalone]

#2332

Em 26-09-2013 00:38, Rick Jones escreveu:
> Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
> 
>> I have a home local network 192.168.1.xxx.
>> Recently, sometimes I have the following situation:
>> Pinging a computer that is off I got some messages like this:
> 
>> From 10.39.191.254: icmp_seq=2 Packet filtered
> 
>> This is very rare, but happens.
> 
>> Does anybody know its meaning?
> 
> Your local home network - is it wired or wireless?  Is it connected
> via a home "router" to an ISP?  If so, what is the IP address the ISP
> assigned to the home router (the ISP/"WAN" side, not your local
> network side).
> 
Using ntop I could find 2 IP addresses for the MAC of the modem router:
The gateway (192.168.1.1) and 10.39.191.254.
I think this IP address is local to the ISP network.

Now, why the ping caused that strange message if the host name is in the
hosts files of all PCs in my network? Besides this message began to
occur only recently.

Anyway, knowing what this address is no longer exists any security
problem I was afraid of.

Thanks to all who responded.

[toc] | [prev] | [next] | [standalone]

#2333

On 26.9.13 4:36 , Paulo da Silva wrote:
> Em 26-09-2013 00:38, Rick Jones escreveu:
>> Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
>>
>>> I have a home local network 192.168.1.xxx.
>>> Recently, sometimes I have the following situation:
>>> Pinging a computer that is off I got some messages like this:
>>
>>>  From 10.39.191.254: icmp_seq=2 Packet filtered
>>
>>> This is very rare, but happens.
>>
>>> Does anybody know its meaning?
>>
>> Your local home network - is it wired or wireless?  Is it connected
>> via a home "router" to an ISP?  If so, what is the IP address the ISP
>> assigned to the home router (the ISP/"WAN" side, not your local
>> network side).
>>
> Using ntop I could find 2 IP addresses for the MAC of the modem router:
> The gateway (192.168.1.1) and 10.39.191.254.
> I think this IP address is local to the ISP network.
>
> Now, why the ping caused that strange message if the host name is in the
> hosts files of all PCs in my network? Besides this message began to
> occur only recently.
>
> Anyway, knowing what this address is no longer exists any security
> problem I was afraid of.
>
> Thanks to all who responded.

This seems quite clear:

1. Your ISP is using a RFC1918 private address range (10.x.y.z) for
    its clients.

2. Your router attempts to send the ping to the outside network
    when the switched-off computer does not respond to ARP request.

3. Your router detects an attempt to access the local network
    (192.168.u.w) via the outside and filters it.

This is a mild misbehavior of the router. It should not attempt
to access the local network via the outside, and it should report
an unaccessible host when the ARP is not responded to.

-- 

Tauno Voipio

[toc] | [prev] | [next] | [standalone]

#2334

Em 26-09-2013 06:23, Tauno Voipio escreveu:
...

> 
> This seems quite clear:
> 
> 1. Your ISP is using a RFC1918 private address range (10.x.y.z) for
>    its clients.
> 
> 2. Your router attempts to send the ping to the outside network
>    when the switched-off computer does not respond to ARP request.
> 
> 3. Your router detects an attempt to access the local network
>    (192.168.u.w) via the outside and filters it.
> 
> This is a mild misbehavior of the router. It should not attempt
> to access the local network via the outside, and it should report
> an unaccessible host when the ARP is not responded to.
> 
Yes. May be that. The fact that it has recently begun to occur may be
due to an eventual firmware update of the router by the ISP.

Thank you very much for your enlightment.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web