Odd 10.48.32.1 address in tracert

[Lance]

Can someone help me understand the tracert result shown way down below?
I don't understand the 10.48.32.1 entry neither does my cable company.
What the heck is it? What more can I do the figure it out?

I'm running a wired/wireless home network connected to a cable modem
like so:

MyComputers (192.168.1.x) to
MyRouter (192.168.1.1) to
MyCableModem (192.168.100.1)

If I run a tracert from MyComputers to any IP address, the first hop
after the router is always 10.48.32.1. My router has a trace function
and the first hop is also 10.48.32.1.

If I understand things correctly, 10.48.32.1 (whatever it is), exists on
the "internet" side of my router and is a non-routable address. This
does not make sense to me. I can ping 10.48.32.1, cannot connect to it
using telnet ("connect failed") or web browser (...connection was
refused...).

Other info:

My internet IP is assigned dynamically by earthlink (24.x.x.x). Cable
equipment is supplied by TimeWarner. All computers run WinXP SP2.
ipconfig /all and route print don't show any sort of 10.x.x.x entries.

TimeWarner was at my house today to swap out a bad cable modem. I asked
him about the 10.48.32.1 address and he couldn't explain it. He assumed
it was some virus/intrusion and just about freaked out.

I run reasonable security layers on my LAN (router firewall, Windows
Firewall, WEP, Spybot S&D 1.3/1.4, AdAware 1.06, Symantec AV 9.0,
SpywareBlaster 3.4, MVPS HOSTS file, all definitions updated and clean
scans). I don't see any odd or unfamiliar processes, excess internet
traffic, unknown DHCP clients, unusual behavior, etc.

Lance
*****

C:\>tracert google.com

Tracing route to google.com [216.239.37.99]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 6 ms 5 ms 5 ms 10.48.32.1
3 6 ms 7 ms 6 ms xxx.socal.rr.com
4 7 ms 16 ms 15 ms yyy.socal.rr.com
etc,etc until the trace reaches google

 

[Richard G. Harper]

I have a similar entry in every tracert I run, my cable company tells me
it's a neighborhood router in our cable network.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

 

[Jetro]

Funny but only cable companies have the setup when you can see your
gateway/their router internal private IP. xDSL providers treat their stuff
and staff differently. BTW, tracert doesn't show border router IP in any of
my networks.
Just curious if your cable modem has a built-in router as well.

 

[Richard G. Harper]

Nope, no router; and the modem has an IP address different from the 10.x.x.x
address anyway. The cable company told me exactly what I said - it's a
"neighborhood router" on the circuit and that this is not abnormal for cable
networks. Don't have DSL so I didn't know if it had similar.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

 

[Jetro]

Actually I asked the OP who has MyCableModem with 192.168.100.1 address and
I've refreshed some knowledge already.

The customer-side IP address of a DOCSIS cable modem is normally
192.168.100.1 (this is not normal for cable modems I'm aware of but this is
forgivable ).

Cable connection ends up at Cable Modem Termination System or UBR (Universal
Broadband Router). UBR has both public and private IPs on the same interface
to host multiple subnets. The client sends the packets to UBR's public IP
assigned to the client as her Default Gateway IP. UBR originates every
packet to end-user from its private IP. This private IP has the same MAC as
the client's public Default Gateway IP.
If you traceroute to the gateway, the public gateway IP address will reply.
If you traceroute through the gateway, the UBR's private IP address will
reply as well.
If you traceroute gateway's private IP, you'll get no reply.

 

[Lance]

Thank you Richard and Jetro for helping me out. The new cable modem is
an RCA DCM315. Has an internet jack or you can use USB, but doesn't
operate as a router.

Jetro is right for the most part (I do get an answer when I tracert the
private IP) and I guess you can consider the UBR a "neighborhood"
router. It's a little strange the guy who replaced my modem didn't know
about it. Here are the tracerts and results:


C:\>tracert 24.152.aaa.bbb (gateway for router)
1 <1 ms <1 ms <1 ms 192.168.1.1
2 6 ms 6 ms 7 ms user-xxxxxxxxx.mindspring.com

C:\>tracert google.com
1 <1 ms <1 ms <1 ms 192.168.1.1
2 16 ms 6 ms 7 ms 10.48.32.1
3 7 ms 6 ms 5 ms ccc.socal.rr.com
etc etc

C:\>tracert 10.48.32.1
1 <1 ms <1 ms <1 ms 192.168.1.1
2 6 ms 7 ms 5 ms 10.48.32.1

Running tracert directly from the router results in 1 hop to 10.48.32.1

Thanks everyone.

Lance
*****


Jetro thought carefully and wrote on 6/2/2005 6:30 PM:

 

[Jetro]

UBR is the only router in the "neighbourhood" from the cable end-user's
point of view. Its private IP address doesn't participate in trace route
process as well as any additional IP of any known router on the route isn't
involved in trace. Router responds with the best valid path IP address.
No wonder a low-level techie knows a little about DOCSIS and UBRs standards
and setup. Not every 2nd level support engineer knows more.