What is this?

Discussion in 'Linux Networking' started by Paulo da Silva, Sep 25, 2013.

  1. Hi,

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Thanks for any help.
     
    Paulo da Silva, Sep 25, 2013
    #1
    1. Advertisements

  2. Paulo da Silva

    Greg Foster Guest

    "Filtered" suggests a firewall. The replying IP does not appear to be on your home network. Could it be the external IP of your router or internet connection device?

    You might also try running a traceroute to see what path is being taken. Traffic between two local computers should not generate any additional hops in a trace.

    It wouldn't hurt to verify the network masks on all participants to make sure they match.

    -Greg
    Hi,

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Thanks for any help.
     
    Greg Foster, Sep 25, 2013
    #2
    1. Advertisements

  3. Paulo da Silva

    Marc Haber Guest

    A local computer? By IP or by host name? If host name, to which IP
    does the host name resolve when it happens? If IP, are you sure that
    you're pinging the right address?

    Greetings
    Marc
     
    Marc Haber, Sep 25, 2013
    #3
  4. Em 25-09-2013 16:11, Greg Foster escreveu:
    I couldn't find this address anywhere! There's only one modem/router
    connected to the ISP. There's only one network 192.168.1.xxx.

    traceroute 10.39.191.254
    traceroute to 10.39.191.254 (10.39.191.254), 30 hops max, 60 byte packets
    1 * * *
    2 * * *
    ....
    30 * * *

    # ping 10.39.191.254
    PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
    ^C
    --- 10.39.191.254 ping statistics ---
    9 packets transmitted, 0 received, 100% packet loss, time 7999ms

    Both commands were issued with the firewall deactivated.
    traceroute does not work with the firewall activated.
     
    Paulo da Silva, Sep 25, 2013
    #4
  5. Em 25-09-2013 17:11, Marc Haber escreveu:
    By host name. It is defined in the /etc/hosts file.
     
    Paulo da Silva, Sep 25, 2013
    #5
  6. Paulo da Silva

    Tauno Voipio Guest


    The 10.x.y.z address group belongs to RFC1918 private,
    locally administered addresses, along with 192.168.u.w
    and a certain group of 172.s.t.q addresses.

    If you are the local network administrator, you should
    know why it is in /etc/hosts.
     
    Tauno Voipio, Sep 25, 2013
    #6
  7. Em 25-09-2013 19:08, Paulo da Silva escreveu:
    Yet more strange. Right now I got this with the firewal disabled:
    ping 10.39.191.254
    PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
    From 10.39.191.254: icmp_seq=5 Packet filtered
    ^C
    --- 10.39.191.254 ping statistics ---
    16 packets transmitted, 0 received, +1 errors, 100% packet loss, time
    15000ms

    Most of the time this doesn't happen. Only very few times.
     
    Paulo da Silva, Sep 25, 2013
    #7
  8. Em 25-09-2013 19:19, Tauno Voipio escreveu:
    Sorry. What I meant was that that the host name and the IP were int
    hosts file but the ip is 192.168.1.22.

    Here is the line:
    192.168.1.22 deimos.homenet.pt deimos
     
    Paulo da Silva, Sep 25, 2013
    #8
  9. Paulo da Silva

    Rick Jones Guest

    Your local home network - is it wired or wireless? Is it connected
    via a home "router" to an ISP? If so, what is the IP address the ISP
    assigned to the home router (the ISP/"WAN" side, not your local
    network side).

    rick jones
     
    Rick Jones, Sep 26, 2013
    #9
  10. Em 26-09-2013 00:38, Rick Jones escreveu:
    Using ntop I could find 2 IP addresses for the MAC of the modem router:
    The gateway (192.168.1.1) and 10.39.191.254.
    I think this IP address is local to the ISP network.

    Now, why the ping caused that strange message if the host name is in the
    hosts files of all PCs in my network? Besides this message began to
    occur only recently.

    Anyway, knowing what this address is no longer exists any security
    problem I was afraid of.

    Thanks to all who responded.
     
    Paulo da Silva, Sep 26, 2013
    #10
  11. Paulo da Silva

    Tauno Voipio Guest

    This seems quite clear:

    1. Your ISP is using a RFC1918 private address range (10.x.y.z) for
    its clients.

    2. Your router attempts to send the ping to the outside network
    when the switched-off computer does not respond to ARP request.

    3. Your router detects an attempt to access the local network
    (192.168.u.w) via the outside and filters it.

    This is a mild misbehavior of the router. It should not attempt
    to access the local network via the outside, and it should report
    an unaccessible host when the ARP is not responded to.
     
    Tauno Voipio, Sep 26, 2013
    #11
  12. Em 26-09-2013 06:23, Tauno Voipio escreveu:
    ....
    Yes. May be that. The fact that it has recently begun to occur may be
    due to an eventual firmware update of the router by the ISP.

    Thank you very much for your enlightment.
     
    Paulo da Silva, Sep 26, 2013
    #12
  13. Paulo da Silva

    Marc Haber Guest

    If that was pasted, it's correct. Please paste ip addr and ip route's
    output as well.

    Greetings
    Marc
     
    Marc Haber, Sep 27, 2013
    #13
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.