[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <519682C0.6010509@baribault.net>
Date: Fri, 17 May 2013 15:19:28 -0400
From: Gary Baribault <gary@...ibault.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: My ISP is routing traffic to private
addresses...
I'm with a largish cable provider in Quebec, and they use the 10.x.x.x
network throughout theirs, but if you're trying to access a 172.30
device inside your private home or work network why is that traffic
escaping to your ISP? If you're trying to access 172.30.x.x devices over
the Internet, it's not supposed to work.
$ traceroute -n www.videotron.com
traceroute to www.videotron.com (24.201.243.21), 30 hops max, 60 byte
packets
1 192.168.0.2 0.137 ms 0.064 ms 0.071 ms
2 * * *
3 10.170.169.49 16.351 ms 17.245 ms 17.185 ms
4 10.170.162.214 12.740 ms 13.593 ms 13.539 ms
5 10.170.167.14 24.527 ms 25.335 ms 25.282 ms
6 10.170.177.165 18.039 ms 18.904 ms 18.833 ms
7 10.170.163.177 14.135 ms 9.233 ms 12.787 ms
8 10.170.163.182 13.678 ms 12.584 ms 11.337 ms
etc...
If I was using 10.x.x.x then I would route the traffic inside, I use
192.168.0.x at home, so 10 would leak to the net, but that's RFC'd not
to work.
Gary Baribault
On 05/17/2013 03:08 PM, kyle kemmerer wrote:
> So today when trying to access a device on my network (172.30.x.x
> range) I was taken to the web interface of a completely different
> device. This baffled me at first, but after a bit of poking around, I
> determined that my ISP was actually routing traffic to these
> addresses. See the trace below
>
>
> Tracing route to 172.30.4.18 over a maximum of 30 hops
>
> 1 11 ms 18 ms 19 ms XXXXXXXXX
> 2 30 ms 178 ms 212 ms vl4.aggr1.phdl.pa.rcn.net
> <http://vl4.aggr1.phdl.pa.rcn.net> [208.59.252.1]
> 3 13 ms 18 ms 13 ms tge0-1-0-0.core1.phdl.pa.rcn.net
> <http://tge0-1-0-0.core1.phdl.pa.rcn.net> [207.172.15.50]
>
> 4 37 ms 39 ms 57 ms tge0-0-0-2.core1.lnh.md.rcn.net
> <http://tge0-0-0-2.core1.lnh.md.rcn.net> [207.172.19.227]
>
> 5 35 ms 34 ms 32 ms tge0-1-0-1.core1.chgo.il.rcn.net
> <http://tge0-1-0-1.core1.chgo.il.rcn.net> [207.172.19.235
> ]
> 6 42 ms 38 ms 39 ms port-chan13.aggr2.chgo.il.rcn.net
> <http://port-chan13.aggr2.chgo.il.rcn.net> [207.172.15.20
> 1]
> 7 37 ms 39 ms 39 ms
> port-chan1.mart-ubr1.chi-mart.il.cable.rcn.net
> <http://port-chan1.mart-ubr1.chi-mart.il.cable.rcn.net> [
> 207.229.191.132]
> 8 57 ms 61 ms 53 ms 172.30.4.18
>
> Trace complete.
>
>
> So I break out nmap and do a quick scan, and find that there are
> thousands of these devices across this IP range. Has anybody ever
> seen anything like this? Surely this must be a mistake, right? If
> anybody else is using RCN as an ISP, can you access these addresses as
> well?
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists