# Strange traceroute results advice please!!!



## noidpara (Apr 27, 2010)

Hi I run on a mac osX machine and use an aircard for my internet access but when I do a traceroute to say google.. I always get timeouts on my first and third hops. An IP lookup on the second hop (in the case below) reveals some kind of strange private internet assigned number authority listing with references to the "country being worldwide" What is going on here? how come I can not see where my traffic is passing through? It seems to consistently be the the same ip 172.26.248.2. Any suggestions... am I being subjected to a man in the middle type situation here? Is the man in the middle behind the isp according to the trace route have a look and see what you think any suggestions would be greatly appreciated..

traceroute to google.com (72.14.204.103), 64 hops max, 52 byte packets
1 * * *
2 172.26.248.2 (172.26.248.2) 278.035 ms 406.617 ms 400.117 ms
3 * * *
4 172.16.192.34 (172.16.192.34) 279.961 ms 373.752 ms 345.964 ms
5 12.88.7.205 (12.88.7.205) 359.957 ms 378.686 ms 379.938 ms
6 cr83.cgcil.ip.att.net (12.122.152.130) 429.252 ms 461.103 ms 467.880 ms
7 cr1.cgcil.ip.att.net (12.123.7.110) 430.958 ms 438.284 ms 429.922 ms
8 cr1.cl2oh.ip.att.net (12.122.2.206) 431.946 ms 399.643 ms 397.904 ms
9 cr2.cl2oh.ip.att.net (12.122.2.126) 418.988 ms 399.160 ms 419.981 ms
10 cr2.phlpa.ip.att.net (12.122.2.210) 419.931 ms 451.181 ms 419.632 ms
11 cr1.wswdc.ip.att.net (12.122.4.54) 430.940 ms 418.125 ms 427.937 ms
12 12.122.135.153 (12.122.135.153) 429.948 ms 416.705 ms 389.977 ms
13 12.88.155.14 (12.88.155.14) 359.924 ms 388.223 ms 399.991 ms
14 216.239.48.108 (216.239.48.108) 399.963 ms 387.197 ms 389.791 ms
15 66.249.94.54 (66.249.94.54) 399.971 ms
66.249.94.46 (66.249.94.46) 417.702 ms
66.249.94.54 (66.249.94.54) 410.691 ms
16 iad04s01-in-f103.1e100.net (72.14.204.103) 388.108 ms 379.767 ms 388.982 ms


Thanks


----------



## scottsee (Feb 28, 2007)

noidpara said:


> An IP lookup on the second hop (in the case below) reveals some kind of strange private internet assigned number authority listing with references to the "country being worldwide" What is going on here?


Iana.org is what's going on.. 

http://www.iana.org/about/




> how come I can not see where my traffic is passing through? It seems to consistently be the the same ip 172.26.248.2. Any suggestions... am I being subjected to a man in the middle type situation here? Is the man in the middle behind the isp according to the trace route have a look and see what you think any suggestions would be greatly appreciated..


MIM attacks use poised arp cash to trick computers into thinking a diffrent machine on the lan segment is the local default gateway. It would be your first hop ip address if you were subject to that form of packet snooping..

I don't anything wrong, I'm not sure why you're timing out...


----------



## noidpara (Apr 27, 2010)

Thanks for such a quick response.. I am somewhat familiar with IANA but not with the type network that iana assigns to that range (forgive me I am not sure if I am even saying that right!) but what could be causing me to time out only on those hops? Could those ip addresses intentionally be preventing their identification somehow?

Thanks


----------



## scottsee (Feb 28, 2007)

I'm not really sure. I know that routers can be configured to not send icmp replys, but I'm not sure if the TTL field will continue to increment until it reaches it's destination, or how how many attempts it makes per request.. I'm not an expert on ICMP, sorry..

I do know that all versions of windows send requests differently, but the specifics of your results, I can' help you. Are you at home, work, school?


----------



## noidpara (Apr 27, 2010)

I am at home ok no problem i'll just live with it thanks for the help anyway...


----------

