19

I found a private IP address displayed on a video. What can you learn from a private IP address, if anything at all?

6
  • 14
    You can basically learn nothing from the private IP alone. Anybody can own use such IP address. Jul 23, 2023 at 14:41
  • 22
    This is a little like asking, "what can you know about a house when you know one pet's name?"
    – schroeder
    Jul 23, 2023 at 15:32
  • 3
    OP, Does the IP address have four numbers in it, separated by dots? If so, what is the first number?
    – mti2935
    Jul 23, 2023 at 15:39
  • 30
    Can we have a reality check here please: do you mean that an IP address that you know is in one of the private (RFC-1918 etc.) ranges, or that a numeric IP address has been displayed which you would normally consider to be private information? Jul 24, 2023 at 10:45
  • What, exactly, do you mean by a "private" address? How is a "private" address different from a normal address? Jul 26, 2023 at 13:50

4 Answers 4

48

Private IP addresses as defined by RFC 1918 (10.0.0.0/8, 172.16.0.0/12 & 192.168.0.0/16) can be used as anyone wishes, so a private IP address alone does not tell much and nothing is definite. However, many use the defaults from their router vendor, so on some occasions that might give a hunch on which kind of network equipment there are in use.

Again, any of the following is not definite and you would need to cross-check from other sources like the MAC address of the router or its login page. None of this information would be available on a video displaying just the IP address, so you would need an access to the network. Still, it is already some start for reconnaissance.

  • 10.0.0.0/24, 192.168.0.0/24, 192.168.1.0/24 & 192.168.2.0/24 are so common that it could be anything.
  • 10.8.0.0/24 suggests it might be an OpenVPN with default configuration.

If no link for another source, the following subnets are based on the articles from TechSpot & Software Testing Help, but ordered by subnets rather than brands. Brands are only listed for delimiting subnets.

Subnet Router Brand(s)
10.0.0.0/24 More than 10 possibilities
10.0.1.0/24 Apple, WatchGuard Firebox
10.1.1.0/24 Belkin, D-Link
10.10.1.0/24 Asus
10.90.90.0/24 D-Link
172.16.16.0/24 Sophos Firewall
192.168.0.0/24 More than 10 possibilities
192.168.1.0/24 More than 10 possibilities
192.168.2.0/24 More than 10 possibilities
192.168.3.0/24 Amped Wireless, Huawei
192.168.4.0/24 Zoom, Zyxel
192.168.8.0/24 Eminent, Huawei
192.168.10.0/24 Motorola, NetComm, Repotec, Trendnet, Zoom, Zyxel
192.168.11.0/24 Buffalo
192.168.15.0/24 D-Link, Linksys, Motorola, Sweex
192.168.16.0/24 Repotec, Linksys
192.168.20.0/24 Motorola, NetComm
192.168.30.0/24 Motorola
192.168.42.0/24 Android (USB Tethering)
192.168.43.0/24 Android (WiFi Tethering)
192.168.44.0/22 Android (Bluetooth Tethering)
192.168.48.0/24 Android (Bluetooth Tethering)
192.168.50.0/24 Sweex
192.168.55.0/24 Sweex
192.168.62.0/24 Motorola
192.168.86.0/24 Google (only on Techspot article)
192.168.88.0/24 MikroTik
192.168.100.0/24 Huawei, Motorola, Thomson, ZTE
192.168.102.0/24 Motorola
192.168.123.0/24 LevelOne
192.168.168.0/24 Sonicwall
192.168.178.0/24 FRITZ!Box
192.168.251.0/24 Sweex
192.168.254.0/24 Actiontec

The lists are not exhaustive.

11
  • 1
    192.168.100.1 is the common address for most cable modems, so it's not meaningful.
    – Barmar
    Jul 24, 2023 at 5:55
  • 1
    192.168.178.0/24 is used by FritzBox. Jul 24, 2023 at 8:24
  • 1
    192.168.88.0/24 Mikrotik
    – fraxinus
    Jul 24, 2023 at 8:55
  • 1
    @Barmar it strongly depends on which brand of modem and/or which ISP. 100 is absolutely not universal.
    – user253751
    Jul 24, 2023 at 9:51
  • 3
    True, AFAIK it's the specific address 192.168.100.1, I don't think the entire subnet is used for anything. But if you see that address in the video, it's a good bet it's a cable modem.
    – Barmar
    Jul 24, 2023 at 20:14
13

There's nothing that can be said with certainty, but it does help make assumptions:

  • You can try deduce the smallest possible subnet: e.g. if you see 10.2.8.7 then one can assume that 10.2.8.1 - 10.2.8.254 might be reachable
  • Seeing an address end in .1 or .254 might indicate the default gateway, and might, with some country or ISP specific info tell you which ISP they have (e.g. in the Netherlands 192.168.178.1 is usually the Fritz!Box gateway, and the ISPs that give Fritz!Boxes here are.. 2? 3? depending on the region even 1)
  • It might help make assumptions about their LAN topology and location (usually where I come from 172.16/12 might be located in an educational institute, 10.x usually used by companies, 192.168.x.x usually personal homes)
1
  • 5
    Consider a /24 is not the smallest subnet. It could be a /30, or in some cases a /31, or even a point to point address (though that is unlikely)
    – Criggie
    Jul 24, 2023 at 22:24
5

You can learn that's it private (not routable on the Internet), that's it.

1

You can assume that if this RFC1918 IPv4 address is used to get to the internet at large, then there is a device somewhere in the path doing NAT.

That NAT device might be the router, and it might be doing DHCP and DNS and NTP services as well.


Or it could be fake info put there in a video for a laugh or a hidden message or "dog whistle". There are some Nazi-related numbers that fit inside the 0-255 range.

Example: My IP could be 10.69.420.1337 (but it isn't)

3
  • 7
    Your ip could not be 10.69.420.1337 FWIW. Jul 26, 2023 at 7:11
  • @kevinSpaceyIsKeyserSöze exactly right - if we saw that on screen it would be obviously done as a joke. I didn't want to list the other kind of numbers I mentioned.
    – Criggie
    Jul 26, 2023 at 8:54
  • 1
    fair enough I wouldn't want to mention those either! Jul 26, 2023 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .