Unidentified IP address keep popping up (10.8.11.178)

[zer0isme]

My NoScript keeps blocking a suspicious IP address 10.8.11.178 while opening some (most) websites. I had tried to find who is this 10.8.11.178 but I could not get any info about it.
Once I marked this IP address as Untrusted, I got trouble with my internet account by my ISP (sudden disconnected due exceeded maximum quota {their version}; but my modem usage log said the other wise around {my quota has been stolen by my ISP, my version}). But till now I do not know whether it is related or not.
Is there anyone with the same experience? Can anyone help me figure it out who is this IP 10.8.11.178 ?

Thanks in advance.

[zer0isme]

Sorry for posting at wrong category
Admin can you help me moving this post into the right topic (general may be). Thanks.

[dhouwn]

It's an non-Internet IP, maybe some transparent proxy by the ISP for allegedly saving bandwidth through compression? You are on 3G or therelike?

[GµårÐïåñ]

10.0.0.0/8 is a class A address range and can ONLY be used for private addressing, they have no public facing internet access and are not recognized by any directory services. So check your setup, something is setup to use this IP and it has to be on your LAN environment.

[dhouwn]

and it has to be on your LAN environment.

Could be the ISP too, they give you a private IP and let you access the Internet through NAT. I suspect this might be a transparent caching proxy on their network.

[GµårÐïåñ]

ISPs rarely if ever will dole out private IPs for their clients, even using NAT. Now if you are talking about VPC and Dynamic NAT over T lines which are are cost effective solutions for mid to large scale businesses, then its possible in a logical misconfiguration, but highly unlikely its the case with the OP. Even a DLCI Frame Relay Encapsulation will require a legitimate WAN IP to be used despite the star or hub-and-spoke configuration to run a partial or full mesh configuration because the fact is that those VCs still go through the "cloud" which means although internally they can have whatever IP, they have to be statically NAT-ed to a real IP. Basics of networking. Someone used a private IP where they shouldn't have or misconfigured the routing the table or the NAT lookup table, simple as that.

[GµårÐïåñ]

BTW, doesn't matter if you have a branch in London, one in LA, and one in Timbuktu, the fact is that the INTERNAL portion of the network configuration is always referred to as LAN, despite the physical sparsity of it. And the public side is always called a WAN even if the two locations were two floors in the same building. So, as said before, a LAN misconfiguration, whether by the ISP or the client or a tool that did something wrong. 10.0.0.0/8 is internal private addressing period.

[dhouwn]

ISPs rarely if ever will dole out private IPs for their clients, even using NAT.

Huh? Why else would the use NAT then? They do it exactly for the purpose of fighting the exhaustion of non-private IP addresses. Just checked with my 3G stick (which I otherwise rarely use), using the default APN I get an IP from the 10.0.0.0/8 range.

[therube]

10.x.x.x is non-routable (just like 192.x.x.x).
Perfectly fine for a LAN, but not forward facing to the Internet.

Noted elsewhere, http://www.whatismyip.com/ or in Error Console, NoScript should note your IP (if you're early enough since start up).

Something (odd) like Satellite or in some places might be a "giant" LAN NAT'd to an ISP's singular web facing IP?


OP is from Indonesia? Nortel LNWR100T router perhaps?


I've left these untranslated:

http://ratihonline.blogspot.com/2011/11/10811178.html

http://www.indowebster.web.id/showthrea ... 19&page=13

[GµårÐïåñ]

Huh? Why else would the use NAT then? They do it exactly for the purpose of fighting the exhaustion of non-private IP addresses. Just checked with my 3G stick (which I otherwise rarely use), using the default APN I get an IP from the 10.0.0.0/8 range.

I was trying to be civil but if you are going to roll your eyes, let me emphatically say that you have no clue what you are talking about and yes the private range is used to avoid using public IPs but regardless of how much private IPs you use INTERNALLY and how often you use NAT, the public IPs are REQUIRED for it to work on the internet, collectively referred to as the cloud. I am not going to debate someone who has nothing to add by condescension and lack of knowledge. NAT is used to route a bunch of internally configured IPs to a single or multiple public addresses, not to route a private IP. Private IPs are NOT routable, period, using NAT simply manages them within a network, NOT ON THE WAN side but on the LAN side. Your 3G stick is using subnetting, whereby an entity will allocate IPs internally to different groups and then using summary or simply super-netting to use a public IP to give them access to the internet, doesn't make the Class A/10.x.x.x/8 routable or public, NAT or not. The life cycle of your 10. IP ends at the router and sometimes even at the switch if you are dealing with VLANs. Your router's WAN exit interface, AKA, the gateway to your 10. IP, is the one that is public and will see the world, not your 10. IP. Also when it comes to private IPs of Class A 10. or Class C 192.168. no one has to give you squat, it doesn't belong to anyone because they are not public, no ISP will give them to you, you can use them all you want, the public IPs are the ONLY thing an ISP can GIVE you. In fact the ISP's responsibility to your network ends at the demarcation point, where they give you the link to the internet, the internal network topology, is your problem. Just like theirs is their problem, you don't manage or control it.

[zer0isme]

Wow, thanks all of you.
I have limited networking knowledge, most infos described here I could not understand
Right now I am using an EVDO modem stick, wireless single PC/laptop user, located in Indonesia.
But before this while using my 3G modem stick this unknown IP address never pop up.

Infos from @thecube :... thanks
http://ratihonline.blogspot.com/2011/11/10811178.html -> someone assumed this is intelligent/secret service IP address? (i hate being spied)
http://www.indowebster.web.id/showthrea ... 19&page=13 -> somone managed to trace this IP address is from Africa ?
Which one is the right one?

Just checking my connection, my IPv4 address and DNS Servers are at 10.x.x.x range (automatic configuration) but no 10.8.11.178 mentioned.

So, is this IP address 10.8.11.178 safe for me so I can allow it as whitelist on my NoScript?

Thanks a heap.

[dhouwn]

There must be a misunderstanding here I never claimed that IPs from this range are accessible from the outside or routable on the Internet, what I meant is that OP might not be directly connected to the Internet but to a (V)LAN from the ISP instead, and NAT is what then makes it possible for users on this ISP to access the Internet.
The IP OP sees might then be from a caching server from this same internal network he/she is on (but probably not a network in the sense that one could access other users on this ISP directly), the references to the original content etc. might have been replaced by a transparent proxy in order to save bandwidth.

Again, what IPs other than private ones would an ISP using NAT deal out to his users? What the user's machine sees is a non-routable IP address, what a server on the Internet sees of course not (that's the magic made possible through NAT), I never claimed the opposite.

[GµårÐïåñ]

Just checking my connection, my IPv4 address and DNS Servers are at 10.x.x.x range (automatic configuration) but no 10.8.11.178 mentioned.

So, is this IP address 10.8.11.178 safe for me so I can allow it as whitelist on my NoScript?

Thanks a heap.

Yes you can allow them, if you are using 3G or a pool style assignment, you might be locally subnetted and globally NAT-ed using routes in the router to get you to the internet since they are still using the GPRS framework, poor man's router on a stick but if you use 4G, you will be assigned actual public addresses as they cannot NAT you or use subnetting routes to pool you, or should I say they won't not that they can't. You are going to deal with that number changing, so to allow any variations in the future, just manually whitelist 10. and that way it will cover any future variations of the IP you might get, just like you can do 192.168 and it will automatically temp whitelist all the rest of the addresses. Or not, do them individually, there is that too.

[zer0isme]

So IP 10.x.x.x is the good guys, confirmed.
Thanks all of you.

[GµårÐïåñ]

They are internal addresses, not publicly routed, so generally they are LAN based therefore harmless. Yes.