I found a private IP address displayed on a video. What can you learn from a private IP address, if anything at all?
Private IP addresses as defined by RFC 1918 (
192.168.0.0/16) can be used as anyone wishes, so a private IP address alone does not tell much and nothing is definite. However, many use the defaults from their router vendor, so on some occasions that might give a hunch on which kind of network equipment there are in use.
Again, any of the following is not definite and you would need to cross-check from other sources like the MAC address of the router or its login page. None of this information would be available on a video displaying just the IP address, so you would need an access to the network. Still, it is already some start for reconnaissance.
192.168.2.0/24are so common that it could be anything.
10.8.0.0/24suggests it might be an OpenVPN with default configuration.
If no link for another source, the following subnets are based on the articles from TechSpot & Software Testing Help, but ordered by subnets rather than brands. Brands are only listed for delimiting subnets.
|10.0.0.0/24||More than 10 possibilities|
|10.0.1.0/24||Apple, WatchGuard Firebox|
|192.168.0.0/24||More than 10 possibilities|
|192.168.1.0/24||More than 10 possibilities|
|192.168.2.0/24||More than 10 possibilities|
|192.168.3.0/24||Amped Wireless, Huawei|
|192.168.10.0/24||Motorola, NetComm, Repotec, Trendnet, Zoom, Zyxel|
|192.168.15.0/24||D-Link, Linksys, Motorola, Sweex|
|192.168.42.0/24||Android (USB Tethering)|
|192.168.43.0/24||Android (WiFi Tethering)|
|192.168.44.0/22||Android (Bluetooth Tethering)|
|192.168.48.0/24||Android (Bluetooth Tethering)|
|192.168.86.0/24||Google (only on Techspot article)|
|192.168.100.0/24||Huawei, Motorola, Thomson, ZTE|
The lists are not exhaustive.
There's nothing that can be said with certainty, but it does help make assumptions:
- You can try deduce the smallest possible subnet: e.g. if you see 10.2.8.7 then one can assume that 10.2.8.1 - 10.2.8.254 might be reachable
- Seeing an address end in .1 or .254 might indicate the default gateway, and might, with some country or ISP specific info tell you which ISP they have (e.g. in the Netherlands 192.168.178.1 is usually the Fritz!Box gateway, and the ISPs that give Fritz!Boxes here are.. 2? 3? depending on the region even 1)
- It might help make assumptions about their LAN topology and location (usually where I come from 172.16/12 might be located in an educational institute, 10.x usually used by companies, 192.168.x.x usually personal homes)
You can learn that's it private (not routable on the Internet), that's it.
You can assume that if this RFC1918 IPv4 address is used to get to the internet at large, then there is a device somewhere in the path doing NAT.
That NAT device might be the router, and it might be doing DHCP and DNS and NTP services as well.
Or it could be fake info put there in a video for a laugh or a hidden message or "dog whistle". There are some Nazi-related numbers that fit inside the 0-255 range.
Example: My IP could be 10.69.420.1337 (but it isn't)