[TriLUG] Why is 1.1.1.1 on my network?

[matt at noway2.thruhere.net]

If I remember the article I saw on this subject correctly, a big problem
with this address range is that it was unallocated, but heavilly polluted.
 A lot of sites out there are using addresses in the 1.x.x.x and 2.x.x.x
range.  One thing you may find is that there is a conflict with multiple
sites claming them and depending on where your tools look, you can get
different and ambiguous results.

> On Wed, Mar 3, 2010 at 11:33, Scott Lambdin <lopaki at gmail.com> wrote:
>> If it is not in your arp cache, then I guess it must be routed?
>>  Traceroute?
>
> Scott is right.  This becomes a basic layer 2 versus layer 3
> networking question.  It is absolutely worth learning the difference
> if you want to feel more confident in your networking troubleshooting
> skills.
>
> In this case, if your test host's routing table doesn't have a route
> that matches 1.1.1.1, it will forward it to the routing table's
> default gateway.  The only ARP entry in use at that point is that of
> that gateway.
>
> Traceroute, mtr, and hping are great tools to see where it actually
> does live out there on the network.
>
>   - Jeff
> --
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
>