Puzzled by modem IP address

[Jez]

I'm sure there's a simple answer to this

Having figured out how to view my modem's configuration page (thanks folks!), I was a bit surprised to see an IP address of 10.147.xxx.xxx which isn't in the range that
Robin Walker's pages indicate it should be ... A tracert shows the first hop via my wireless router, second confirms the 10.47.xxx.xxx address.

Using All Net Tools SmartWhois indicates this is in a range assigned to IANA in California ...

So I'm confused! Why isn't my address apparently a valid NTL one? And, er, is this a problem?

[mmm]

Firstly to nthellworld Jez

The cable modem (and other ntl routing devices) have a private address which is unique within the ntl network only, these are allowed by "RFC 1918 Address Allocation for Private Internets February 1996"

3. Private Address Space

The Internet Assigned Numbers Authority (IANA) has reserved the
following three blocks of the IP address space for private internets:

10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

This is not your internet IP address which you find out from...

http://www.all-nettools.com/pr.htm

for example

NB many sites incorrectly quote the ntl proxy cache as your address, the cache changes depending on which size you check as each only handle a portion of the IP address space

[Web-Junkie]

That number could be the IP of the UBR you are connected to!

[Jez]

Ah! Thanks for that - I was worried I'd been hijacked or something! I suppose I don't really need/want to know why the modem has its own address space for private internets, do I Ho hum.

[mmm]

Originally Posted by Jez

... I suppose I don't really need/want to know why the modem has its own address space for private internets, do I Ho hum.

It is an intelligent device, it likes to talk privately to other intelligent devices inside the ntl network, but you wouldn't want it talking to strangers on the internet!

Originally Posted by mmm

This is not your internet IP address which you find out from...

http://www.all-nettools.com/pr.htm

Arrrggg - we have our own ......

http://www.nthellworld.co.uk/home?nav=tools&exec=proxy

[mmm]

Originally Posted by Paul M

Arrrggg - we have our own ......

http://www.nthellworld.co.uk/home?nav=tools&exec=proxy

Sorry,

This nearly works for me

You are using the following NTL proxy : oxfd-cache-2.server.ntli.net

This is an UNKNOWN NTL Proxy Server.

Originally Posted by mmm

Sorry,

This nearly works for me

Fixed - a small typo.

[daxx]

Originally Posted by mmm

It is an intelligent device, it likes to talk privately to other intelligent devices inside the ntl network, but you wouldn't want it talking to strangers on the internet!

The mind bogglea at the thought of 'what if' all intelligent devices in NTL decided to takea over the running of the company, experiences posted here and on the old board show that the 'life at the top' seems somewhat lacking, at times, in this commodity

[Jez]

Funny that - the idea of all these so-called intelligent devices communicating privately with each other didn't exactly fill me with confidence either

What are they communicating about, exactly? I know my router uses its private address space 192.168.xxx.xxx to operate my home network, but what's the modem up to?

[BBKing]

Getting its CM configuration file, getting firmware upgrades, getting remotely monitored for connection quality details...

STBs add assorted interactive functions and TV related stuff to this. You need the modem to have an IP for the system to work.

[dave_tracey]

Hi,

I've been having intermittent speed issues with my NTL 1.5Mbps BB service. I know its a long-winded post (Sorry!), but it is kinda connected (?) to this topic.

I've got a Belkin wireless Router (but normally only 1 PC is switched on at a time), I checked the security log on this, every 30 ish seconds, there was a DoS attack from 10.116.32.1. I figured this was fine, if a little annoying, but the firewall was doing its job.

However, this morning, I lost connectivity totally, after a bit of jiggery pokery I managed to get myself back up. BUT, the service was very flakey, so I tried a couple of ping & tracert tests. (See Below)

******
Tracing route to www.google.akadns.net [216.239.59.147]
over a maximum of 30 hops:

1 1 ms <1 ms 1 ms MY ROUTER
2 7 ms 5 ms 45 ms 10.116.32.1
3 7 ms 7 ms 6 ms pool-t2cam1-b-ge-wan34-104.inet.ntl.com [80.5.168.149]
4 9 ms 7 ms 7 ms sot3-t2core-b-pos71.inet.ntl.com [80.4.225.137]
5 9 ms 9 ms 8 ms gfd-bb-b-so-330-0.inet.ntl.com [62.253.185.53]
6 11 ms 27 ms 11 ms bre-bb-a-so-000-0.inet.ntl.com [213.105.172.149]
7 11 ms 11 ms 10 ms redb-ic-1-so-010-0.inet.ntl.com [62.253.188.106]
8 11 ms 12 ms 12 ms 195.66.224.125
9 42 ms 22 ms 40 ms 216.239.49.254
10 21 ms 23 ms 56 ms 216.239.49.114
11 25 ms 42 ms 40 ms 216.239.59.147

Trace complete.
******

The attacking IP is appearing at the start of EVERY tracert.

I thought the router might have been hacked, so removed that (tracert below)

******
Tracing route to www.google.akadns.net [216.239.59.147]
over a maximum of 30 hops:

1 6 ms 5 ms 5 ms 10.116.32.1
2 8 ms 5 ms 5 ms pool-t2cam1-b-ge-wan34-104.inet.ntl.com [80.5.168.149]
3 7 ms 7 ms 9 ms sot3-t2core-b-pos71.inet.ntl.com [80.4.225.137]
4 10 ms 8 ms 8 ms gfd-bb-b-so-330-0.inet.ntl.com [62.253.185.53]
5 19 ms 11 ms 10 ms bre-bb-a-so-000-0.inet.ntl.com [213.105.172.149]
6 10 ms 11 ms 10 ms redb-ic-1-so-010-0.inet.ntl.com [62.253.188.106]
7 19 ms 14 ms 12 ms 195.66.224.125
8 22 ms 40 ms 21 ms 216.239.49.254
9 36 ms 23 ms 41 ms 216.239.49.121
10 24 ms 41 ms 39 ms 216.239.59.147

Trace complete.
******

Clearly this didn't fixed it, so I tried plugging the modem direct to another PC, which had exactly the same problem.

This pointed me towards the modem! It is an ntl:home 120. After reading you're v. helpful forum I managed to get its IP as 10.170.xxx.xxx

The Internet connection is still up & down like a tart's draws and intermittently slow

I don't understand how or why everything is being routed through this 10.116.32.1. Furthermore, I don't know if this IP could be causing a bottleneck in my web access..? If anyone can shed any light on it, I'd be incredibly greatful! (Tried to ring NTL, but after 20 mins on hold, got bored!)

Cheers!

P.S. Let me know if any more info required!

[Jez]

I'm a bit puzzled (again!) by your 10.116.xxx.xxx AND the 10.170.xxx.xxx addresses but it was exactly this same thing that made me ask the question in the first place. My router was also reporting DOS attacks from the IP address which is why I did a whois on it but which we've now established is in fact my modem's private address (and though I'm not at it right now, I'm pretty sure appeared second in a tracert report) ... Since I'm also having intermittent drop-outs and some speed problems, AND I've a Belkin wireless router, is there something that dave_tracey and I are missing here? Should the router's firewall apparently be blocking our modem in this way and is this causing a problem?

[dave_tracey]

Jez, your first post mentions 2 ip addresses: 10.147.xxx.xxx & 10.47.xxx.xxx. Is this correct, or a typo? If it is correct, then maybe the modem has 2 IP's..? - This would explain why mine were completely different (10.170.x.x reported on Modem config page & 10.116.x.x on DoS attacks), but it doesn't go anywhere near explaining why the router thinks the modem is attacking it... any ideas anyone?

[BBKing]

Typo, I'd have thought.

10.116.32.1 is ntl's UBR in your area (UBR 1 Charminster, in fact), it's allowed to send you packets! It's the device that connects you to the internet, so it's technically correct to say it's a bottleneck, but only in the sense that it's the only way your traffic can go to get anywhere.

10.170.x.x is the private cable modem range for that area. 10.116.x.x is the private STB range for that area.

Just because a router thinks it's being DOSed doesn't mean it is - it's not a security expert.

Your modem's IP will NEVER appear in a traceroute - it passes traffic a layer below IP so will not show up at the IP layer (for this reason it's called a transparent bridge). You're almost certainly seeing your UBR there instead.