routing - RFC 1918 address on open internet?

itemprop="text">

In trying to diagnose a failover
problem with my Cisco ASA 5520 firewalls, I ran a traceroute to www.btfl.com and, much
to my surprise, some of the hops came back as RFC 1918
addresses.

Just to be clear, this host is not
behind my firewall and there is no VPN involved. I have to connect across the open
internet to get there.

How/why is this
possible?

asa# traceroute
            www.btfl.com


Tracing the route to
            157.56.176.94

 1 
 2
            
 3 
 4 

            5 nap-edge-04.inet.qwest.net (67.14.29.170) 0 msec 10 msec 10 msec
 6
            65.122.166.30 0 msec 0 msec 10 msec
 7 207.46.34.23 10 msec 0 msec 10
            msec
 8 * * *

 9 207.46.37.235 30 msec 30 msec 50
            msec
 10 10.22.112.221 30 msec
 10.22.112.219 30 msec

            10.22.112.223 30 msec
 11 10.175.9.193 30 msec 30 msec
 10.175.9.67
            30 msec
 12 100.94.68.79 40 msec
 100.94.70.79 30 msec

            100.94.71.73 30 msec
 13 100.94.80.39 30 msec


            100.94.80.205 40 msec
 100.94.80.137 40 msec
 14 10.215.80.2 30
            msec
 10.215.68.16 30 msec
 10.175.244.2 30 msec
 15 * *
            *
 16 * * *
 17 * *
            *

and it
does the same thing from my FiOS connection at
home:

C:\>tracert
            www.btfl.com

Tracing route to www.btfl.com
            [157.56.176.94]
over a maximum of 30 hops:

 1 1 ms <1
            ms <1 ms myrouter.home [192.168.1.1]
 2 8 ms 7 ms 8 ms
            
 3 10 ms 13 ms 11 ms 

 4
            12 ms 10 ms 10 ms ae2-0.TPA01-BB-RTR2.verizon-gni.net [130.81.199.82]
 5 16 ms
            16 ms 15 ms 0.ae4.XL2.MIA19.ALTER.NET [152.63.8.117]
 6 14 ms 16 ms 16 ms
            0.xe-11-0-0.GW1.MIA19.ALTER.NET [152.63.85.94]
 7 19 ms 16 ms 16 ms
            microsoft-gw.customer.alter.net [63.65.188.170]
 8 27 ms 33 ms *
            ge-5-3-0-0.ash-64cb-1a.ntwk.msn.net [207.46.46.177]
 9 * * * Request timed
            out.
 10 44 ms 43 ms 43 ms 207.46.37.235
 11 42 ms 41 ms 40 ms
            10.22.112.225
 12 42 ms 43 ms 43 ms 10.175.9.1
 13 42 ms 41 ms 42 ms
            100.94.68.79

 14 40 ms 40 ms 41 ms 100.94.80.193
 15 * *
            * Request timed out.

class="post-text" itemprop="text">

class="normal">Answer

It is
permissible for routers to connect to each other using RFC1918 or other private
addresses, and in fact this is very common for things like point-to-point links, and any
routing that takes place inside an AS.

Only the
border gateways on a network actually need publicly routeable IP addresses for routing
to work. If a router's interface doesn't connect to any other ASes (or any other service
providers, more simply), there is no need to advertise the route on the internet, and
only equipment belonging to the same entity will need to directly connect to the
interface.

That the packets return to you this
way in traceroute is a slight violation of RFC1918, but it isn't actually necessary to
use NAT for these devices as they don't connect to arbitrary things on the internet
themselves; they just pass along
traffic.

That the traffic takes the
(possibly circuitous) route through several organizations that it does is merely a
consequence of the operation of exterior gateway routing protocols. It seems perfectly
reasonable that Microsoft has some backbone and some people have peered with it; you
don't have to be a wholesale ISP to route
traffic.

That the traffic has gone through
multiple series of routers with private IPs, transiting through ones with public IPs in
between, is not especially strange - it simply indicates (in this case) two different
networks along the path have routed the traffic through their own routers which they
have chosen to number in this way.