This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Stress Removal

IP from private range in wireshark capture

2 min read

This thread's last reply is from May 11, 2009, 7:18 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Hi,
i installed wireshark on Ubuntu 8.04 yesterday and was connected to net wirelessly. I ran wireshark as sudo. Here is a line from packets captured on wireless interface:

who has? .................... tell
10.232.218.1................ 10.232.218.117

Now my IP begins with 192.168 and same for my default gateway. From what little knowledge I have, this seems to be and ARP msg but how come its from some IP address other than my computer (i.e. 10.232.218.117 )

Also there was a line "Zhongxin_81:94:e7" which was an ARP broadcast.

Can anyone please explain what these two things mean?

Thank you.
The IP range 10.0.0.0 - 10.255.255.255 is reserved by IANA for private internets.

Its fully described in this article, https://www.arin.net/knowledge/rfc/rfc1918.txt

Its therefore assumed that your machine is connected to a private network.
I am just a home user with only one laptop connected with wireless.

Is it a security concern?
"mak_20789" wrote:was connected to net wirelessly
Was that your own personal wifi router that is connected to your ISP, or were you connected to a public network?

If you connecetd to a public network, you may find that the IP 10.232.218.1 is the networks IP.

If you connected thru your own wifi router then take a look at the logs, see if you can see anything about the connection from them to 10.232.218.1

This forum helps windows users with malware problems, we dont have the analatical tools available that would allow an indepth analysis of a *nix system, so i would suggest you try the Ubuntu forum who should be able to help you.
"Orac" wrote: Was that your own personal wifi router that is connected to your ISP, or were you connected to a public network?


No, its my own router connected to ISP, not a public network.



If you connected thru your own wifi router then take a look at the logs, see if you can see anything about the connection from them to 10.232.218.1


Logs of my router didnt say anything about any IP address.

This forum helps windows users with malware problems, we dont have the analatical tools available that would allow an indepth analysis of a *nix system, so i would suggest you try the Ubuntu forum who should be able to help you.


I just thought of it as a general question of Private IP address appearing in wireshark capture.
Anyways, I am getting help from Ubuntu forums. Just wanted to see if anyone else has had the same experience.
Thank you.

(Btw, can you please tell me whats wrong with the quote feature i have used?)
"mak_20789" wrote:(Btw, can you please tell me whats wrong with the quote feature i have used?)


You had BBCode disabled in your post editor (see the boxes below the input field).

I've re-enabled it for you.