• What is this?

    From Paulo da Silva@110:110/2002 to All on Wed Sep 25 05:16:09 2013
    Hi,

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Thanks for any help.

    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Marc Haber@1:0/0 to All on Wed Sep 25 16:11:05 2013
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=3D2 Packet filtered

    A local computer? By IP or by host name? If host name, to which IP
    does the host name resolve when it happens? If IP, are you sure that
    you're pinging the right address?

    Greetings
    Marc
    --=20
    -------------------------------------- !! No courtesy copies, please !! =
    -----
    Marc Haber | " Questions are the | Mailadresse im =
    Header
    Mannheim, Germany | Beginning of Wisdom " | =
    http://www.zugschlus.de/
    Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 =
    72739834

    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: private site, see http://www.zugschlus.de/ f
  • From Paulo da Silva@110:110/2002 to All on Wed Sep 25 18:08:42 2013
    Em 25-09-2013 16:11, Greg Foster escreveu:

    .....
    Could it be the external IP of your router or
    internet connection device?

    I couldn't find this address anywhere! There's only one modem/router
    connected to the ISP. There's only one network 192.168.1.xxx.


    You might also try running a traceroute to see what path is being
    taken.
    traceroute 10.39.191.254
    traceroute to 10.39.191.254 (10.39.191.254), 30 hops max, 60 byte packets
    1 * * *
    2 * * *
    ....
    30 * * *

    # ping 10.39.191.254
    PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
    ^C
    - --- 10.39.191.254 ping statistics ---
    9 packets transmitted, 0 received, 100% packet loss, time 7999ms

    Both commands were issued with the firewall deactivated.
    traceroute does not work with the firewall activated.



    Paulo da Silva<p_s_d_a_s_i_l_v_a@netcabo.pt> 9/24/2013 10:16 PM >>>
    Hi,

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Thanks for any help.




    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Paulo da Silva@110:110/2002 to All on Wed Sep 25 18:12:50 2013
    Em 25-09-2013 17:11, Marc Haber escreveu:
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    A local computer? By IP or by host name? If host name, to which IP
    does the host name resolve when it happens?

    By host name. It is defined in the /etc/hosts file.



    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Tauno Voipio@110:110/2002 to All on Wed Sep 25 18:19:05 2013
    On 25.9.13 9:12 , Paulo da Silva wrote:
    Em 25-09-2013 17:11, Marc Haber escreveu:
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    A local computer? By IP or by host name? If host name, to which IP
    does the host name resolve when it happens?

    By host name. It is defined in the /etc/hosts file.


    The 10.x.y.z address group belongs to RFC1918 private,
    locally administered addresses, along with 192.168.u.w
    and a certain group of 172.s.t.q addresses.

    If you are the local network administrator, you should
    know why it is in /etc/hosts.

    --

    Tauno Voipio


    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: A noiseless patient Spider (110:110/2002@linuxnet)
  • From Paulo da Silva@110:110/2002 to All on Wed Sep 25 18:20:34 2013
    Em 25-09-2013 19:08, Paulo da Silva escreveu:
    Em 25-09-2013 16:11, Greg Foster escreveu:

    ....
    Could it be the external IP of your router or
    internet connection device?

    I couldn't find this address anywhere! There's only one modem/router connected to the ISP. There's only one network 192.168.1.xxx.


    You might also try running a traceroute to see what path is being
    taken.
    traceroute 10.39.191.254
    traceroute to 10.39.191.254 (10.39.191.254), 30 hops max, 60 byte packets
    1 * * *
    2 * * *
    ...
    30 * * *

    # ping 10.39.191.254
    PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
    ^C
    --- 10.39.191.254 ping statistics ---
    9 packets transmitted, 0 received, 100% packet loss, time 7999ms

    Both commands were issued with the firewall deactivated.
    traceroute does not work with the firewall activated.


    Yet more strange. Right now I got this with the firewal disabled:
    ping 10.39.191.254
    PING 10.39.191.254 (10.39.191.254) 56(84) bytes of data.
    From 10.39.191.254: icmp_seq=5 Packet filtered
    ^C
    - --- 10.39.191.254 ping statistics ---
    16 packets transmitted, 0 received, +1 errors, 100% packet loss, time
    15000ms

    Most of the time this doesn't happen. Only very few times.



    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Paulo da Silva@110:110/2002 to All on Wed Sep 25 18:27:46 2013
    Em 25-09-2013 19:19, Tauno Voipio escreveu:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    A local computer? By IP or by host name? If host name, to which IP
    does the host name resolve when it happens?

    By host name. It is defined in the /etc/hosts file.


    The 10.x.y.z address group belongs to RFC1918 private,
    locally administered addresses, along with 192.168.u.w
    and a certain group of 172.s.t.q addresses.

    If you are the local network administrator, you should
    know why it is in /etc/hosts.

    Sorry. What I meant was that that the host name and the IP were int
    hosts file but the ip is 192.168.1.22.

    Here is the line:
    192.168.1.22 deimos.homenet.pt deimos


    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Rick Jones@110:110/2002 to All on Wed Sep 25 23:38:02 2013
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Your local home network - is it wired or wireless? Is it connected
    via a home "router" to an ISP? If so, what is the IP address the ISP
    assigned to the home router (the ISP/"WAN" side, not your local
    network side).

    rick jones
    --
    Process shall set you free from the need for rational thought.
    these opinions are mine, all mine; HP might not want them anyway... :)
    feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: the Unofficial HP (110:110/2002@linuxnet)
  • From Paulo da Silva@110:110/2002 to All on Thu Sep 26 01:36:42 2013
    Em 26-09-2013 00:38, Rick Jones escreveu:
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Your local home network - is it wired or wireless? Is it connected
    via a home "router" to an ISP? If so, what is the IP address the ISP assigned to the home router (the ISP/"WAN" side, not your local
    network side).

    Using ntop I could find 2 IP addresses for the MAC of the modem router:
    The gateway (192.168.1.1) and 10.39.191.254.
    I think this IP address is local to the ISP network.

    Now, why the ping caused that strange message if the host name is in the
    hosts files of all PCs in my network? Besides this message began to
    occur only recently.

    Anyway, knowing what this address is no longer exists any security
    problem I was afraid of.

    Thanks to all who responded.


    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Tauno Voipio@110:110/2002 to All on Thu Sep 26 05:23:12 2013
    On 26.9.13 4:36 , Paulo da Silva wrote:
    Em 26-09-2013 00:38, Rick Jones escreveu:
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:

    I have a home local network 192.168.1.xxx.
    Recently, sometimes I have the following situation:
    Pinging a computer that is off I got some messages like this:

    From 10.39.191.254: icmp_seq=2 Packet filtered

    This is very rare, but happens.

    Does anybody know its meaning?

    Your local home network - is it wired or wireless? Is it connected
    via a home "router" to an ISP? If so, what is the IP address the ISP
    assigned to the home router (the ISP/"WAN" side, not your local
    network side).

    Using ntop I could find 2 IP addresses for the MAC of the modem router:
    The gateway (192.168.1.1) and 10.39.191.254.
    I think this IP address is local to the ISP network.

    Now, why the ping caused that strange message if the host name is in the hosts files of all PCs in my network? Besides this message began to
    occur only recently.

    Anyway, knowing what this address is no longer exists any security
    problem I was afraid of.

    Thanks to all who responded.

    This seems quite clear:

    1. Your ISP is using a RFC1918 private address range (10.x.y.z) for
    its clients.

    2. Your router attempts to send the ping to the outside network
    when the switched-off computer does not respond to ARP request.

    3. Your router detects an attempt to access the local network
    (192.168.u.w) via the outside and filters it.

    This is a mild misbehavior of the router. It should not attempt
    to access the local network via the outside, and it should report
    an unaccessible host when the ARP is not responded to.

    --

    Tauno Voipio


    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: A noiseless patient Spider (110:110/2002@linuxnet)
  • From Paulo da Silva@110:110/2002 to All on Thu Sep 26 14:06:57 2013
    Em 26-09-2013 06:23, Tauno Voipio escreveu:
    ....


    This seems quite clear:

    1. Your ISP is using a RFC1918 private address range (10.x.y.z) for
    its clients.

    2. Your router attempts to send the ping to the outside network
    when the switched-off computer does not respond to ARP request.

    3. Your router detects an attempt to access the local network
    (192.168.u.w) via the outside and filters it.

    This is a mild misbehavior of the router. It should not attempt
    to access the local network via the outside, and it should report
    an unaccessible host when the ARP is not responded to.

    Yes. May be that. The fact that it has recently begun to occur may be
    due to an eventual firmware update of the router by the ISP.

    Thank you very much for your enlightment.


    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: Aioe.org NNTP Server (110:110/2002@linuxnet)
  • From Marc Haber@1:0/0 to All on Fri Sep 27 05:07:15 2013
    Paulo da Silva <p_s_d_a_s_i_l_v_a@netcabo.pt> wrote:
    Here is the line:
    192.168.1.22 deimos.homenet.pt deimos

    If that was pasted, it's correct. Please paste ip addr and ip route's
    output as well.

    Greetings
    Marc
    --=20
    -------------------------------------- !! No courtesy copies, please !! =
    -----
    Marc Haber | " Questions are the | Mailadresse im =
    Header
    Mannheim, Germany | Beginning of Wisdom " | =
    http://www.zugschlus.de/
    Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 =
    72739834

    --- MBSE BBS v1.0.0 (GNU/Linux-i386)
    * Origin: private site, see http://www.zugschlus.de/ f