I am using the freeware version on PP and quite like it. Thank you for making it available. I have a question about the results I have been receiving.

I have noticed that regardless of what IP I trace, the third entry in the results is always 192.168.15.105. I do not recognize this IP as one of my LAN IP's and I cannot ping it unless I am connected to the internet. I am surpised to see this as a IP on the internet, as I understand it to be in the range private use only.

Sample Results:
Target Name: www.weatherunderground.com
IP: 66.28.250.176
Date/Time: 10/9/2004 11:16:31 AM

1 1 ms [192.168.0.1]
2 56 ms h-66-167-28-1.phndaz91.dynamic.covad.net [66.167.28.1]
3 56 ms [192.168.15.105]
4 55 ms ge-8-0-139.hsa1.Phoenix1.Level3.net [63.214.160.137]
5 64 ms so-6-2-0.mp2.Phoenix1.Level3.net [4.68.113.253]
6 73 ms ge-0-1-0.bbr2.SanJose1.Level3.net [64.159.1.130]
7 72 ms so-7-0-0.edge1.SanJose1.Level3.net [209.244.3.142]
8 73 ms cogent-level3-oc48.SanJose1.Level3.net [4.68.127.18]
9 74 ms p6-3.core01.sjc01.atlas.cogentco.com [154.54.2.233]
10 74 ms p4-0.core01.sfo01.atlas.cogentco.com [66.28.4.93]
11 74 ms g49.ba01.b001865-0.sfo01.atlas.cogentco.com [66.250.8.234]
12 81 ms [66.28.250.176]

Anyone have any ideas or suggestions?

I am new to this sort of investigation so the answer could be obvious to many.

Thanks

Hi, Ian.

Keep in mind the way traceroute (and PingPlotter) works. PingPlotter sends out a packet with TTL set to an incrementing number - 1 for the first hop, 2 for the second, etc. (See http://www.pingplotter.com/tutorial/HowItWorks.html for more details about this theory).

As each hop receives a packet, it decrements this number. If TTL = 0 after the decrement, it slaps *it's* IP address in the packet and kicks it back. This IP Address is the address we display.

Sometimes, the router decides not to return packets with TTL=0 (in these cases, you'll often have a hop that just doesn't have any information displayed). Sometimes, a router might not even decrement the TTL, in which case it just doesn't appear in the route (this is relatively rare with the current technology in internet routers). When a router does respond, it puts its IP Address in - but any router might have more than one IP address. Does it put in the address of the interface it received the packet from, or the one it would have sent it out on? Maybe it just drops in the primary interface address - even though that one might not have been involved in routing packets anyway. Your hop 3 is including a private IP address - even though this router could certainly have some additional "routable" addresses as well - it's picked this interface to report back to you.

Normally, the reported IP Address give enough information to understand ownership issues, but sometimes it might report an IP that doesn't fit with your expectations. Remember how traceroute works - the router makes a decision about what IP to report back. For a while, tracing to nessoft.com turned up a 192.168.x.x address at hop N-1 (13 hops from the computer running PingPlotter). There's *no way* that this IP Address was routeable from us, but it did participate in the route. It might have had other public interfaces that had publicly routeable IPs, but it decided to report its 192.168 address.

This is why PingPlotter always, for each sample set, sends out packets using the decrementing TTL method rather than doing it just once and then targeting the individual routers explicitly. Some of the IPs being reported back are totally non-routeable, and trying to ping one of them would drop a packet off some distance from the actual router.

Good question! Let us know if this doesn't make sense.

- Pete

Thank you for your reply. Appreciate your efforts!