closed not a support question
new_u
offlineMember
Destination Gateway Genmask Flags Metric Ref Use Iface
127.0.0.1 * 255.255.255.255 UH 0 0 0 lo
192.168.10.0 * 255.255.255.0 U 0 0 0 eth0
default 192.168.10.1 0.0.0.0 UG 0 0 0 eth0192.168.10.1 is my home router acting as 'gateway'. But what is 192.168.10.0 ??? And what does * mean under the Gateway column?
TIA!
kultex
offlineKey Master
if you use route -n instead of route then you see * = 0.0.0.0
try "ip route show" - that explains the routing a little bit better
tux@slitaz:~ $ ip route show
default via 192.168.5.1 dev eth0
127.0.0.0/8 dev lo
192.168.5.0/24 dev eth0 src 192.168.5.195
kultex
offlineKey Master
new_u
offlineMember
Here's a bit more info
http://stackoverflow.com/questions/8599424/understanding-routing-table-entry
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 1 0 0 eth0"This says that any packet with a destination of 192.168.1.0 through 192.168.1.255 will be sent out eth0 without using a gateway (unless a more-specific route overrides this one)."
What still baffles me is that I can ping 192.168.10.0 (or 192.168.1.0 in the above case), and get a response, so apparently 192.168.10.0 isn't being treated as a generic name for a subnetwork, but as an actual address...
gdesilva
offlineMember
@new_u,
In your case, 192.168.10.0 denotes the network where 192.168.10.1 and all other devices, such as 192.168.10.2 etc..., reside - ie your private home network. And provided your network mask is 255.255.255.0, 192.168.10.255 will be the broadcast address for all devices on this network. That leaves, 192.168.10.1 to 192.168.10.254 addresses for any other devices on your network.
So, if you have a PC with 192.168.10.2 and it wants to talk to a printer 192.168.10.3, your pc will know that the printer is on your own network (by applying the network mask) so it will ask for the MAC address of the printer from your router and directly communicate with the printer. If the PC wants to talk to Google, by using the same logic, it knows that the Google servers are on another network, so will forward the request to your gateway, the router, to work out how to get there.
Hope this makes sense.
new_u
offlineMember
gdesilva,
Thanks for your reply. Yes, I understand your explanation.
I did a bit more reading and learnt that a class C network can have 254 hosts. In theory there are 256 host addresses, from 0 to 255.
However the address 255 is reserved for broadcast, like you said, and I should assume that the address 0 isn't a valid address either?
The thing is, like I previously mentioned, I can ping 192.168.10.0 and get a reply. So it seems to be a valid address after all. Now, the packet sniffer tells me that when pinging 192.168.10.0, the reply packet comes from 192.168.10.1 (the router).
Maybe this is some non-standard behavior of my router? It should ignore pings directed at 192.168.10.0, but it doesn't?
kultex
offlineKey Master
thats really strange, that you can ping 192.168.10.0
what router firmware do you use - standard router firmware are often a security risk - I always suggest to use only routers you can flash with openwrt or tomato(usb). I used unill 4 month a wgt634u with openwrt and now a ASUS RT-N16 with tomatousb.
Just some recommandations:
Openwrt:
TP-Link TL-WR841N..........................WAN / LAN 100 MB (2.4GHz) 15 €
TP-Link TL-WDR4300........................WAN / LAN 1000 MB 2xUSB (2.4GHz + 5GHz) 47 €
Tomato:
Asus RT-N12 (B/C/D has more RAM)..........................WAN / LAN 100 MB (2.4GHz) 20 €
Asus RT-N18U http://www.linksysinfo.org/index.php?threads/asus-rt-n18u-really-nice-router.70178/ (in EU now only in Poland) 70 €
ASUS RT-N66U dualband, but not so good CPU like RT-N18U 80 - 100€
Netgear R7000 dualband with ARM CPU 140€
and think - a router is something you use for years - so if you buy new, I would go for one of the routers with arm chip - The Netgear would also be a perfect hardware for a SliTaz server..... dual core cortex-A9 (BCM4709) which is compatible with DDR-1600 memory clocked at 1 GHz - 256MB Ram/ 128MB Flash - Read/Write on USB3 60MB/sec - Power less than 8W
gdesilva
offlineMember
You can ping a network address. On my Ubuntu 14.04 and Bodhilinux if I ping the network address it tells me to use 'ping -b xx.xx.xx.xx' and when I do that I get a response from the router. On Slitaz 4.0 I can ping my network address and it does not prompt me to use the -b option. Obviously, slightly different implementations of ICMP on different systems but this itself is not a good reason to throw away your router as it is doing what it is supposed to do!
If you do a trace you will see that the PC will send out ICMP requests to the network address and then the a response coming from the router to the PC. I am using a Cisco867 router so I do not believe that Cisco would have implemented a 'non-standard' ICMP code in their routers.
kultex
offlineKey Master
@gdesilva - yes it does what it does.....
http://www.cnet.com/news/top-wi-fi-routers-easy-to-hack-says-study/
The last sentence of the artikle says, what is reality: "The home router is starting to look like a new cybercrime's perfect back door."
@new_u If you buy a TP-Link TL-WDR4300 look on the wiki http://wiki.openwrt.org/toh/tp-link/tl-wdr4300 - its sometimes better to finde a old version on ebay....
and just look on the warning for the original firmware:
http://sekurak.pl/tp-link-httptftp-backdoor/
gdesilva
offlineMember
@kultex, agree with your comment but what I meant was receiving a ICMP response to a ICMP request directed to the network address alone should not be the reason for OP to throw away his router. As far as I can see this is not a security issue.
From what I have seen, there are so many vulnerabilities in PCs used by people of all walks of life that hacking into a router will be a bit of a masochistic effort for any hacker. Recently, one of my acquaintances got duped into allowing a phone caller pretending to be from Microsoft to disable his PC - it was that simple. But, yes, I do fully agree with you, it is good to close off as many loopholes as possible.
gdesilva
offlineMember
Here it is from the horse's mouth...ie RFC1812
"4.2.3 SPECIFIC ISSUES
4.2.3.1 IP Broadcast Addresses
For historical reasons, there are a number of IP addresses (some
standard and some not) which are used to indicate that an IP packet
is an IP broadcast. A router
(1) MUST treat as IP broadcasts packets addressed to 255.255.255.255
or { <Network-prefix>, -1 }.
(2) SHOULD silently discard on receipt (i.e., do not even deliver to
applications in the router) any packet addressed to 0.0.0.0 or {
<Network-prefix>, 0 }. If these packets are not silently
discarded, they MUST be treated as IP broadcasts (see Section
[5.3.5]). There MAY be a configuration option to allow receipt
of these packets. This option SHOULD default to discarding
them.
(3) SHOULD (by default) use the limited broadcast address
(255.255.255.255) when originating an IP broadcast destined for
a connected (sub)network (except when sending an ICMP Address
Mask Reply, as discussed in Section [4.3.3.9]). A router MUST
receive limited broadcasts.
(4) SHOULD NOT originate datagrams addressed to 0.0.0.0 or {
<Network-prefix>, 0 }. There MAY be a configuration option to
allow generation of these packets (instead of using the relevant
1s format broadcast). This option SHOULD default to not
generating them.
DISCUSSION
In the second bullet, the router obviously cannot recognize
addresses of the form { <Network-prefix>, 0 } if the router has no
interface to that network prefix. In that case, the rules of the
second bullet do not apply because, from the point of view of the
router, the packet is not an IP broadcast packet. "
The way I interpret this is that routers SHOULD NOT respond to a ping to a network address - but it appears either not many vendors have taken much notice of it or there is some other good reason for enabling this feature. Perhaps, some one out there can explain why this is so....
kultex
offlineKey Master
I am not an expert, but the router has to react on the default adress, which is normally x.x.x.1 - thats necessary for diagnosis, but not on x.x.x.0
Edited my post above, because I just found the Netgear R7000 - great little thing - will be my next one, when I will find a cheap used one (I always buy used ones)
This topic has been closed to new replies.
