Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How to tell if you have a Private IP Address or a Public IP Address


  • Please log in to reply
16 replies to this topic

#1 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 01 June 2014 - 11:20 AM

Many of the questions posted here lack important information: does your machine have a Private IP Address or a Public IP Address?
 
So I made a video to show you how to determine this:
 

 
I use Nirsoft's netrouteview because it has a GUI: http://www.nirsoft.net/utils/network_route_view.html
 
Private IP Addresses have the following ranges:
10.0.0.0    - 10.255.255.255
172.16.0.0  - 172.31.255.255
192.168.0.0 - 192.168.255.255

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


BC AdBot (Login to Remove)

 


m

#2 wpgwpg

wpgwpg

  • Members
  • 1,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US of A
  • Local time:06:43 PM

Posted 01 June 2014 - 11:39 AM

 Are you asking for replies?  It's not clear whether you are or not.  Mine's private, assigned by my router via DHCP.  At least that's what it is at home.  I never check it when I'm at a public place where I use my tablet (Google Nexus 7) which has no sensitive info on it.


Everyone with a computer should back his system up to an external hard drive regularly.  :thumbsup:

#3 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 01 June 2014 - 11:53 AM

No, not asking for replies. This is for later reference: when I have to help somebody and need to know if they have a private or public ip address, I'll direct them to this post if they don't know how to determine this.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#4 wpgwpg

wpgwpg

  • Members
  • 1,149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US of A
  • Local time:06:43 PM

Posted 01 June 2014 - 11:55 AM

The subject of your post is a question.  You should change it to something like "How to tell if....".


Everyone with a computer should back his system up to an external hard drive regularly.  :thumbsup:

#5 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 01 June 2014 - 12:04 PM

I think only a mod can change the subject. I don't see how to do it.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#6 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 01 June 2014 - 12:06 PM

And several pinned topics are also questions. Looking for advice from a mod.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#7 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,015 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:10:43 PM

Posted 01 June 2014 - 12:59 PM

I don't think it's too big of a deal, as "How did I get infected?" and "Slow computer?" could be taken as asking a question which wants answers. It wouldn't be too bad to get this pinned as well since it's good information which I see asked a fair bit (of course, up to mods).

 

Yes, I believe only those with mod power in the section can change a title after a topic has been posted. Hopefully one will reply and provide input

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

~Currently in my last year of school, so replies might be more delayed~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#8 scotty_ncc1701

scotty_ncc1701

  • Members
  • 520 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 PM

Posted 01 June 2014 - 05:55 PM

Although RFC-1918 specifies these as "PRIVATE IP ADDRESSES":

10.0.0.0    - 10.255.255.255
172.16.0.0  - 172.31.255.255
192.168.0.0 - 192.168.255.255

The story is incomplete.

"PRIVATE IP ADDRESSES" are for the internal networks and "PUBLIC IP ADDRESSES" are what is seen on the Internet.

For instance, the computers on my home network is:

desktop        192.168.254.1
my laptop      192.168.254.2
wife's laptop  192.168.254.3

But going out to the world, the "PUBLIC IP ADDRESSES" is 75.x.x.x.

================
COX said it best (empasis added by scotty_ncc1701)
================
A PUBLIC IP ADDRESS IS A GLOBALLY UNIQUE NUMBER that identifies a device on the Internet. If you want someone on the Internet to connect to you, then you must tell them your public address. Also known as your "real" or "external" address. Public IP addresses are globally recognized and assigned by the Arin. Arin is the governing body that controls the list of publicly routed IP addresses. YOUR ISP USUALLY GIVES YOU A PUBLIC IP.

A PRIVATE IP ADDRESS IS TYPICALLY ASSIGNED TO DEVICES ON A LAN (LOCAL AREA NETWORK) AND ARE NOT USED OUTSIDE THE LAN. These IP addresses are typically used with a router, where you have multiple computers all sharing the same Internet connection. PRIVATE IP ADDRESSES CANNOT BE USED ON THE INTERNET.

Private addresses are often used for isolated, IP-based networks that will not be connected to the public Internet. InterNIC encourages the use of private addresses for these situations because it reduces the waste of public IP addresses.

However, when using NAT (network address translation), you can have private IP addresses on your local network and use a single public IP address to have them access the internet. Using NAT, you would be able to connect hundreds of computer to your router, and then use one public IP for all computers to access the internet. A router will translate between private and public IP addresses.

REFERENCE FOR ABOVE: http://www.cox.com/business/idaho/support/voice/article.cox?articleId=a2b07280-6ce8-11e0-4e73-000000000000
================

What it boils down to, for most people with computers, as I explain in another post, is that anyone that accesses the Internet has two IPs associated with their computer.  The "PRIVATE IP ADDRESSES" from your ROUTER/MODEM back, and the "PUBLIC IP ADDRESSES", FROM THE ROUTER/MODEM out to the world.

 

The NAT translation is what a router does!

 



#9 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 02 June 2014 - 01:20 AM

I've difficulty understanding the reason for your comment.

Don't you take into account machines that have a public IP address on their NIC?
I've seen several posts here where it turned out the user's machine had a public IP address, and not a private IP address.
And these people have problems figuring this out.
They often go to a site like "what is my IP address", but this doesn't answer the question.
That is why I made my video.

As to using private IP addresses on a LAN: this is just a convention, it is not mandatory. You can use public IP addresses on your LAN, and then NAT them to another public IP address to access the Internet.

The association between a private and public IP address in case of NAT is done at the level of the device that does the NATing. Usually based on port NATing.
This association is not explicited in the PC.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#10 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 02 June 2014 - 08:25 AM

Update: this is a reply to a post that has now disappeared.

 

I'm starting to get the feeling that there is some confusion regarding this topic.

 

There are ISPs that provide you with a network device (ADSL, cablemodem, ...) that you install on your local network and that assigns your machine a private IP address.

And there are ISPs that provide you with a network device that you install on your local network and that assigns your machine a public IP address.

 

To see which IPs are assigned to the NICs (Network Interface Controller) of your machine, you can use the ipconfig command on the command-line.

But this doesn't tell you which NIC is used to access the Internet (unless you have only one NIC with an IP address). To know this, you use the route command.

That's why I used netrouteview in my video (a GUI-equivalent of the route command).

 

Assume that your network device in your home (your ADSL router) assigned your machine a private IP address: 192.168.0.2

You want to connect to my website at IP address 96.126.103.196.

If you perform a packet capture on your machine, you will see a TCP connection with packets that have following characteristics:

 

Source MAC address: the MAC address of your NIC

Destination MAC address: the MAC address of the Ethernet interface on your local network device

Source IP address: 192.168.0.2

Destination IP address: 96.126.103.196

 

If I perform a packet capture on my website, I will see a TCP connection with packets that have following characteristics:

 

Source MAC address: the MAC address of the last router in the connection.

Destination MAC address: the MAC address of the Ethernet interface on my website's server

Source IP address: A public IP address, let's say 91.123.10.5

Destination IP address: 96.126.103.196

 

Your local network device has parformed NAT: Network Address Translation. It has translated the private IP address 192.168.0.2 into public IP address 91.123.10.5.

91.123.10.5 is the public IP address assigned to your local network device by your ISP. It is needed to access the Internet.

So packets that enter your network device via the local interface with source IP address 192.168.0.2 get translated to 91.123.10.5 when they leave the network device via the Internet-facing interface.

And packets that enter your network device via the Internet-facing interface with destination IP address 91.123.10.5 get translated to 192.168.0.2 when they leave the network device via the local interface (*oversimplification).

 

This NATing is completely transparent to both endpoints. Your machine doesn't see that it's private IP address gets translated to a public IP address, and my website doesn't see that your public IP address gets translated to a private IP address.

 

Now, if you have a network device that issues your machine's NIC with a public IP address, no translation takes place.

What you see is what you get. My server sees your public IP address, the one on your machine's NIC.

 

I have an ISP that works with a network device that issues private IP addresses a,d performs NAT.

But I also have VPN services that issue me a public IP address. When I start these VPN connections, a NIC is created for this VPN connection and it is assigned a public IP address.

 

If you use 3G or 4G dongles, you can get a private IP address or a public IP address on the NIC of your dongle.

 

*oversimplification: a decent NAT service will not translate all incoming packets. Simply put, it will only allow through incoming packets that can be linked to outgoing packets.


Edited by Didier Stevens, 02 June 2014 - 08:57 AM.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 49,920 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:43 PM

Posted 02 June 2014 - 07:36 PM

I pinned this topic so it will not get lost and edited the title to avoid confusion.
.
.
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Microsoft MVP Reconnect 2016
Windows Insider MVP 2017
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 70,454 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:43 PM

Posted 02 June 2014 - 08:19 PM

Excellent post and tool Didier, Thanks!
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 03 June 2014 - 07:07 AM

I pinned this topic so it will not get lost and edited the title to avoid confusion.

 

Thanks quietman7!


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#14 Didier Stevens

Didier Stevens
  • Topic Starter

  • BC Advisor
  • 2,536 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:43 PM

Posted 03 June 2014 - 07:07 AM

Excellent post and tool Didier, Thanks!

 

You're welcome boopme!


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2018
MVP_Horizontal_BlueOnly.png

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 49,920 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:43 PM

Posted 03 June 2014 - 01:58 PM

Thanks quietman7!

:thumbup2:
.
.
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Microsoft MVP Reconnect 2016
Windows Insider MVP 2017
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




2 user(s) are reading this topic

0 members, 2 guests, 0 anonymous users