Wireshark, question on IP address and packets

irishdude11

Im looking at wireshark here and it says the source address for all network requests from my pc is 192.168.1.14.

I understand that this is my local internet address, as if I go to this address in firefox it brings up my wampserver homepage. So this is my address in relation to my router? It is not my actual IP address as other computers on the internet would see it. My IP address shows up as (181.141.abc.xyz) on an ip checking website. So have I got all that right?



So then what I cant understand is how packets coming from the net make it to my computer when the destination field in the IP header is being given as 192.168.1.14? As that is not my address on the internet. Can someone explain how these packets get to me when they are being not being sent to my actual internet address?

Spear

This is more for Net and Comms than security I suppose, but the answer here is Network Address Translation.

irishdude11

I know that NAT handles all the differnet IP adddresses under the local router. What I cant understand is when a site sends something to my pc using destination address 192.168.1.14 how it comes to me? As the 192.168.1.14 address is only relevant in a local context, here are millions of pcs out there whose IP address shows up as 192.168.1.14 in ipconfig. So how do the packets get to me if they dont contain my actual internet ip address?

Spear

It doesn't send anything to a 192.168.x.x address, it nevers sees that one. As I said, NAT takes care of that both ways.

KoolKid

Spear wrote: »

This is more for Net and Comms.

Moved.;)

irishdude11

Spear wrote: »

It doesn't send anything to a 192.168.x.x address, it nevers sees that one. As I said, NAT takes care of that both ways.

Well it looks to me like it is sending it to the 192.168.x.x address. I have it open here in front of me. The destination addresses in the IP headers of packets send to me are 192.168.1.14. And when I send packets, my IP address is put in packets as Source: 192.168.1.14.

Here's a screenshot -

Webmonkey

As said above it's the router that handles this routing.

The website sends it back to your "Internet/Public IP" and the router. The router knows that this is for your PC on your network. It handles all this routing.

It's called Port based NAT or overloaded NAT.

The router replaces the dst/src fields of the packet when it sends and receives packets to/from the internet.

Your wireshark is only seeing what happens on your PC/LAN - Router side which will always be local private addresses. (That are sourced or destined for your PC).

NullZer0

http://whatismyipaddress.com/nat

irishdude11

Ok cheers guys. Makes sense now.