How do I find out what this unknown device is on my network?
Backstory:
I have a home PC network that is mixed hardwired and wireless, with a wireless access point and hardwired PCs - connected to a dual-WAN capable router, connected to a cable modem, connected to Cox Internet (only one WAN is in use at present). The LAN is 10.0.0.1/255.255.255.0. WAN is 68.7.112.78/255.255.252.0
For reasons I won't go into here, I recently had occasion to do a tracert to a web site that I frequent:
1 <1 ms <1 ms <1 ms 10.0.0.1
2 8 ms 7 ms 7 ms **10.165.32.1**
3 8 ms 7 ms 7 ms **68.6.14.168**
4 9 ms 9 ms 9 ms 100.120.108.30
5 13 ms 13 ms 13 ms 68.1.1.167
6 23 ms 22 ms 24 ms 68.105.30.190
7 13 ms 14 ms 13 ms a23-57-47-92.deploy.static.akamaitechnologies.com [23.57.47.92]
10.0.0.1 is my router.
10.165.32.1 is nonroutable, but is not on my LAN. What is it? Is it my cable modem?
68.6.14.168 is not my WAN IP address. It is a Cox IP address with no domain name, in the same netblock (NETBLK-SD-RDC-68-6-0-0) as my WAN IP address. My WAN IP address does not appear in the tracert. Why does something other than my WAN IP address appear here?
100.120.108.30 is in a shared address space for service providers,
and the rest appears to be routing to get to an akamai server.
Thanks for any info.
networking routing modem traceroute internet-security
add a comment |
Backstory:
I have a home PC network that is mixed hardwired and wireless, with a wireless access point and hardwired PCs - connected to a dual-WAN capable router, connected to a cable modem, connected to Cox Internet (only one WAN is in use at present). The LAN is 10.0.0.1/255.255.255.0. WAN is 68.7.112.78/255.255.252.0
For reasons I won't go into here, I recently had occasion to do a tracert to a web site that I frequent:
1 <1 ms <1 ms <1 ms 10.0.0.1
2 8 ms 7 ms 7 ms **10.165.32.1**
3 8 ms 7 ms 7 ms **68.6.14.168**
4 9 ms 9 ms 9 ms 100.120.108.30
5 13 ms 13 ms 13 ms 68.1.1.167
6 23 ms 22 ms 24 ms 68.105.30.190
7 13 ms 14 ms 13 ms a23-57-47-92.deploy.static.akamaitechnologies.com [23.57.47.92]
10.0.0.1 is my router.
10.165.32.1 is nonroutable, but is not on my LAN. What is it? Is it my cable modem?
68.6.14.168 is not my WAN IP address. It is a Cox IP address with no domain name, in the same netblock (NETBLK-SD-RDC-68-6-0-0) as my WAN IP address. My WAN IP address does not appear in the tracert. Why does something other than my WAN IP address appear here?
100.120.108.30 is in a shared address space for service providers,
and the rest appears to be routing to get to an akamai server.
Thanks for any info.
networking routing modem traceroute internet-security
add a comment |
Backstory:
I have a home PC network that is mixed hardwired and wireless, with a wireless access point and hardwired PCs - connected to a dual-WAN capable router, connected to a cable modem, connected to Cox Internet (only one WAN is in use at present). The LAN is 10.0.0.1/255.255.255.0. WAN is 68.7.112.78/255.255.252.0
For reasons I won't go into here, I recently had occasion to do a tracert to a web site that I frequent:
1 <1 ms <1 ms <1 ms 10.0.0.1
2 8 ms 7 ms 7 ms **10.165.32.1**
3 8 ms 7 ms 7 ms **68.6.14.168**
4 9 ms 9 ms 9 ms 100.120.108.30
5 13 ms 13 ms 13 ms 68.1.1.167
6 23 ms 22 ms 24 ms 68.105.30.190
7 13 ms 14 ms 13 ms a23-57-47-92.deploy.static.akamaitechnologies.com [23.57.47.92]
10.0.0.1 is my router.
10.165.32.1 is nonroutable, but is not on my LAN. What is it? Is it my cable modem?
68.6.14.168 is not my WAN IP address. It is a Cox IP address with no domain name, in the same netblock (NETBLK-SD-RDC-68-6-0-0) as my WAN IP address. My WAN IP address does not appear in the tracert. Why does something other than my WAN IP address appear here?
100.120.108.30 is in a shared address space for service providers,
and the rest appears to be routing to get to an akamai server.
Thanks for any info.
networking routing modem traceroute internet-security
Backstory:
I have a home PC network that is mixed hardwired and wireless, with a wireless access point and hardwired PCs - connected to a dual-WAN capable router, connected to a cable modem, connected to Cox Internet (only one WAN is in use at present). The LAN is 10.0.0.1/255.255.255.0. WAN is 68.7.112.78/255.255.252.0
For reasons I won't go into here, I recently had occasion to do a tracert to a web site that I frequent:
1 <1 ms <1 ms <1 ms 10.0.0.1
2 8 ms 7 ms 7 ms **10.165.32.1**
3 8 ms 7 ms 7 ms **68.6.14.168**
4 9 ms 9 ms 9 ms 100.120.108.30
5 13 ms 13 ms 13 ms 68.1.1.167
6 23 ms 22 ms 24 ms 68.105.30.190
7 13 ms 14 ms 13 ms a23-57-47-92.deploy.static.akamaitechnologies.com [23.57.47.92]
10.0.0.1 is my router.
10.165.32.1 is nonroutable, but is not on my LAN. What is it? Is it my cable modem?
68.6.14.168 is not my WAN IP address. It is a Cox IP address with no domain name, in the same netblock (NETBLK-SD-RDC-68-6-0-0) as my WAN IP address. My WAN IP address does not appear in the tracert. Why does something other than my WAN IP address appear here?
100.120.108.30 is in a shared address space for service providers,
and the rest appears to be routing to get to an akamai server.
Thanks for any info.
networking routing modem traceroute internet-security
networking routing modem traceroute internet-security
asked Jan 29 at 23:49
RebeccahRebeccah
32
32
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I'm not sure how much you understand (but everything in the traceroute is normal)
Traceroute works by showing you the routers that packets go through to get from you to your destination.
I'm pretty sure that if 10.0.0.1 is your router (which makes sense) then 10.165.32.1 is your providers router. They are probably providing you with the
service - incompetently - using NAT. (I say incompetently because they should be using Carrier Grade NAT and the 100.x.x.x network, nonetheless, using 10.x is fairly commonly used by ISPs)
Your WAN address would not appear in the traceroute because traceroute shows the "next router" address, not the address packets are leaving from - much like your home computers address is not 10.0.0.1 yet the first hop is - IE what you are seeing is equivalent to the LAN Interface on your router.
I can confirm that it is entirely possible for traceroute to report back private IP addresses in other peoples networks. This is because the packets are not destined for that IP address, rather the TTL packet which decreases for each hop is adjusted so it times out and returns a result. The source address (ie one which the router is replying to) is your WAN interface IP address, so the packet can then be sent back to it.
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
|
show 3 more comments
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1399885%2fhow-do-i-find-out-what-this-unknown-device-is-on-my-network%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I'm not sure how much you understand (but everything in the traceroute is normal)
Traceroute works by showing you the routers that packets go through to get from you to your destination.
I'm pretty sure that if 10.0.0.1 is your router (which makes sense) then 10.165.32.1 is your providers router. They are probably providing you with the
service - incompetently - using NAT. (I say incompetently because they should be using Carrier Grade NAT and the 100.x.x.x network, nonetheless, using 10.x is fairly commonly used by ISPs)
Your WAN address would not appear in the traceroute because traceroute shows the "next router" address, not the address packets are leaving from - much like your home computers address is not 10.0.0.1 yet the first hop is - IE what you are seeing is equivalent to the LAN Interface on your router.
I can confirm that it is entirely possible for traceroute to report back private IP addresses in other peoples networks. This is because the packets are not destined for that IP address, rather the TTL packet which decreases for each hop is adjusted so it times out and returns a result. The source address (ie one which the router is replying to) is your WAN interface IP address, so the packet can then be sent back to it.
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
|
show 3 more comments
I'm not sure how much you understand (but everything in the traceroute is normal)
Traceroute works by showing you the routers that packets go through to get from you to your destination.
I'm pretty sure that if 10.0.0.1 is your router (which makes sense) then 10.165.32.1 is your providers router. They are probably providing you with the
service - incompetently - using NAT. (I say incompetently because they should be using Carrier Grade NAT and the 100.x.x.x network, nonetheless, using 10.x is fairly commonly used by ISPs)
Your WAN address would not appear in the traceroute because traceroute shows the "next router" address, not the address packets are leaving from - much like your home computers address is not 10.0.0.1 yet the first hop is - IE what you are seeing is equivalent to the LAN Interface on your router.
I can confirm that it is entirely possible for traceroute to report back private IP addresses in other peoples networks. This is because the packets are not destined for that IP address, rather the TTL packet which decreases for each hop is adjusted so it times out and returns a result. The source address (ie one which the router is replying to) is your WAN interface IP address, so the packet can then be sent back to it.
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
|
show 3 more comments
I'm not sure how much you understand (but everything in the traceroute is normal)
Traceroute works by showing you the routers that packets go through to get from you to your destination.
I'm pretty sure that if 10.0.0.1 is your router (which makes sense) then 10.165.32.1 is your providers router. They are probably providing you with the
service - incompetently - using NAT. (I say incompetently because they should be using Carrier Grade NAT and the 100.x.x.x network, nonetheless, using 10.x is fairly commonly used by ISPs)
Your WAN address would not appear in the traceroute because traceroute shows the "next router" address, not the address packets are leaving from - much like your home computers address is not 10.0.0.1 yet the first hop is - IE what you are seeing is equivalent to the LAN Interface on your router.
I can confirm that it is entirely possible for traceroute to report back private IP addresses in other peoples networks. This is because the packets are not destined for that IP address, rather the TTL packet which decreases for each hop is adjusted so it times out and returns a result. The source address (ie one which the router is replying to) is your WAN interface IP address, so the packet can then be sent back to it.
I'm not sure how much you understand (but everything in the traceroute is normal)
Traceroute works by showing you the routers that packets go through to get from you to your destination.
I'm pretty sure that if 10.0.0.1 is your router (which makes sense) then 10.165.32.1 is your providers router. They are probably providing you with the
service - incompetently - using NAT. (I say incompetently because they should be using Carrier Grade NAT and the 100.x.x.x network, nonetheless, using 10.x is fairly commonly used by ISPs)
Your WAN address would not appear in the traceroute because traceroute shows the "next router" address, not the address packets are leaving from - much like your home computers address is not 10.0.0.1 yet the first hop is - IE what you are seeing is equivalent to the LAN Interface on your router.
I can confirm that it is entirely possible for traceroute to report back private IP addresses in other peoples networks. This is because the packets are not destined for that IP address, rather the TTL packet which decreases for each hop is adjusted so it times out and returns a result. The source address (ie one which the router is replying to) is your WAN interface IP address, so the packet can then be sent back to it.
answered Jan 30 at 2:13
davidgodavidgo
44k75292
44k75292
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
|
show 3 more comments
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
OK, I see now why 68.7.112.78 would not be on the traceroute. It's another interface on the same device as 10.0.0.1. But I would expect the "next hop" from 68.7.112.78 to be on the same network. So if 10.65.32.1 is Cox's router (my router's "next hop" towards the final destination), does that mean that Cox's router also has an IP address in 68.6.0.0/15 (so, two or more interfaces), and it just chooses to report back the private IP address?
– Rebeccah
Jan 30 at 3:26
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
Its definately possible, but not clear that that is the case. How did you find 68.7.112.78? I could be an external interface of the router on hop 2 or 4 of the traceroute, and NAT being used to deliver back to an IP address range in the 10.165 network - If you log into your router and view the WAN IP address that would confirm either way.
– davidgo
Jan 30 at 3:40
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
68.7.112.78 is from my router's configuration information.
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
WAN1 Link Up Primary Connection: Dynamic IP Status: Connected IP Address: 68.7.112.78 Subnet Mask: 255.255.252.0 Gateway: 68.7.112.1
– Rebeccah
Jan 30 at 3:46
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
So, Cox's router then would have an IP address of 68.7.112.1 and another one of 10.65.32.1?
– Rebeccah
Jan 30 at 3:48
|
show 3 more comments
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1399885%2fhow-do-i-find-out-what-this-unknown-device-is-on-my-network%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown