This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I just want to know how they got there, when I pinged the address, the local address turned into an AT&T address.

alt text

When an attempt is made to ping those local IP addresses that are on a different subnet, the following happens:

alt text

alt text

alt text

It makes no sense to me, as I'm able to ping a local network on a different subnet, let it's showing up as SNMP traffic. Not only that, when pinged the network resolves the 12.83.88.97 and 12.83.88.105 as its actual IP address (both of which are public class A IP addresses belonging to AT&T): http://www.whois.com/whois/12.83.88.105 and http://www.whois.com/whois/12.83.88.97

Anyone know why I'm seeing this Local network traffic? It shouldn't be there I believe.

asked 12 Oct '14, 15:12

Beldum's gravatar image

Beldum
49111116
accept rate: 0%

Anyone? It would be nice to see a response.

(12 Oct '14, 20:33) Beldum

What is your own IP? And can you show the quote of the ICMP packet? That's what should tell why you get an answer like that, but your screenshot doesn't show.

(12 Oct '14, 22:39) Jasper ♦♦

My own local IP address is 192.168.10.101. When you say the quote of the ICMP packet, what do you mean by that? I'm not too familiar with the quote.

(12 Oct '14, 23:41) Beldum

Isn't this just more of the same from your previous question? Now it's getting out of your local subnet via your default gateway, and some device in your ISP's network is reporting that it can't route to the destination.

(13 Oct '14, 03:41) grahamb ♦

Ok Ghraham, the purpose for the question is to make sure that those IP addresses that I listed which are not a part of my local network, should they actually be showing up in SNMP traffic? They are on a different subnet. That's my main concern.

(13 Oct '14, 10:31) Beldum

I suspect that they are still being generated by some widget on your PC searching for an external device, you'll need to use something like MS Message Analyzer that can capture the traffic and show you the sending process to determine what the actual process is.

(13 Oct '14, 10:38) grahamb ♦

Thanks Grahamb, I really appreciate that assistance. I'll try to check it out.

(13 Oct '14, 10:39) Beldum
showing 5 of 7 show 2 more comments

I'd say Graham's answer about the pings is right: when you ping something not in your subnet then it goes out your default router to AT&T's network which sends you back an ICMP saying you can't get to that subnet (through AT&T).

For the SNMP requests whatever the 192.168.10.11 device is, it seems to have that 192.168.1.112 destination programmed into it. Presumably it's not actually succeeding in talking to it since you can't ping it either (and, if this is a home installation with only one subnet, presumably it's not actually something you should be able to reach).

If you're worried about the SNMP requests go find whatever 192.168.10.11 is and try to find some configuration item about 192.168.1.112. Or just unplug the thing. ;-)

permanent link

answered 20 Oct '14, 03:36

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×115
×43
×12
×2

question asked: 12 Oct '14, 15:12

question was seen: 2,750 times

last updated: 20 Oct '14, 03:36

p​o​w​e​r​e​d by O​S​Q​A