N
N
nois2019-02-06 15:45:36
Computer networks
nois, 2019-02-06 15:45:36

Is it normal that I see "gray" IP addresses of my provider?

I accidentally noticed that I can ping some hosts on the 192.168.0.0/16 network in the provider's network (behind his router, judging by the trace).
I connect to the provider via PPPoE:
inet addr: "My_IP" P-t-P: "Prov_IP"
When tracing 192.168.1.2:

1. "My_IP"
2. "Prov_IP"
3. 192.168.1.2

Is it normal? Is it worth it to contact the provider? Should I block the range with a firewall?

Answer the question

In order to leave comments, you need to log in

7 answer(s)
A
Alexey Kirillov, 2019-02-06
@alx0

>Is this normal?
Except if these addresses belong to the interfaces of some service providers - no, of course not.
In your case, these are probably other subscribers.
You can find out yourself using, for example, nmap .
> Is it worth it to contact the provider?
The question is not of a technical nature.
>Should I block the range with a firewall?
Undoubtedly.

G
Gansterito, 2019-02-06
@Gansterito

There are cases when, due to leaking routes, the provider unwittingly gives everyone access to their corporate network. It is possible that the hosts you see are the accountant's computer, a network printer, a security camera, and so on.
However, this is not the case with large providers. In this case, these addresses hang somewhere on the interfaces of routers for some internal tasks, and they pose no danger to either you or the operator.

K
Karpion, 2019-02-06
@Karpion

In the old days, an ISP's internal network was an advantage - and ISPs encouraged users to set up servers within the network. In particular, it was possible to seamlessly distribute pirated content (texts, music, films, programs) in such networks. Now providers are trying to drive users to an external channel so that they buy more expensive tariff plans; Well, they are afraid of Mikhalkov.
Theoretically - the provider itself can give access to its internal servers; these servers can have both a white external address and a gray internal one.
In addition, often the provider's internal routers can have gray internal addresses - this is completely normal.
If you are definitely not going to contact some addresses, it makes sense to block them. But if these addresses belong to the provider, then there is no particular point in blocking them.
I would ask in the support of the provider - what is this address. And you can scan the ports - it will become approximately clear what it is; however, the owner of the device may be offended by the scan of ports.

T
Talyan, 2019-02-06
@flapflapjack

TTC?
Not only was I in your situation in Syktyvkar, but I also saw the ball from subscribers. At what I saw the ball at the Yaroslavl CHP together with the 1C base, but the most interesting thing was that the addresses were "white".
Already covered.
Try this utility https://yadi.sk/d/BgQ97shoithJmw
There, in the settings, check the box "scan to the ball" - I think since such things happen to you, you will also see any shared D: drives without any problems.
True, I do not quite understand the mechanism for viewing shares through PPPoE, but I swear - it's true!

G
Gsetko, 2019-02-06
@Gsetko

This may be due to the port isolation setting on the switch in the case of FTTB networks and most likely these are your neighbors in the yard, and not the provider's network. In this case, you can use the neighbor's Internet

C
CityCat4, 2019-02-07
@CityCat4

Most likely, these are neighboring subscribers. I also see "gray" traffic on the external interface from the provider. But I'm not interested in him, I immediately block him.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question