1

When I try ifconfig.co or whatismyip.com on my MacOS 10.4 I get a completely unknown IP address and it even changes every day or two.

Tried from Safari, Brave, Firefox and even did curl ifconfig.co from the terminal and all show the same IP, currently somewhere in the US (and I'm nowhere near the US) but as I said it changes occasionally to other IPs.

I don't have any proxies set (checked both in Network settings, and in Firefox), the default route shown by netstat -rn points to my home router, but still somehow my traffic gets routed through these weird IP addresses.

I'm not aware of any VPN running either.

What's causing it? What should I check?

MLu
  • 131
  • 1
    Very hard to tell without more info (and you might not want to share all of it, to maintain privacy). Relevant info would include your ISP and internet connection type, what the IP addresses being shown are (esp. who owns them), and what the traceroute Terminal command (e.g. traceroute ifconfig.co) shows about how your computer is reaching the Internet. – Gordon Davisson Oct 18 '19 at 07:48
  • At least a traceroute and the IP whatsmyip shows you would be required to offer any insights. – nohillside Oct 18 '19 at 07:51

2 Answers2

1

Usually in a typical home setup, you'll have "internal" IP-addresses on your home network. Technically known as RFC1918-addresses, they look like this:

10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255

These addresses are only used on your local network in your house, or possible also in a smaller part of your provider's network.

Your internet provider uses various forms for address translation to convert these to globally routable (i.e. useable on the Internet) addresses. Therefore the address others on the Internet perceive as yours is not the same as you see configured on your local computer.

Regarding the country information there's two major sources of errors there:

Firstly, the actual determination of which country an IP address "represents" is not accurate, but based on various information published by providers for other reasons. Therefore it might be you're in for example France, but your IP-address is listed as Belgian, because the internet provider you have has their headquarters in Belgium and uses that postal address for their IP-registration.

Secondly, your traffic might leave your provider's network at different locations depending on destination, time of day, how much capacity is currently used by others, etc. Therefore if you look at traceroutes, it might look as if your traffic "appears" to originate in the US or in Japan, or other places even when you're nowhere near those places.

jksoegaard
  • 77,783
  • Your internet provider uses various forms for address translation to convert these to globally routable (i.e. useable on the Internet) addresses. Isn't it your home router that is doing this? – nekomatic Oct 18 '19 at 12:21
  • @nekomatic The explanation was a bit informal and generalized. The exact answer ofcourse depends on a lot of things. In many places, the ISP chooses and owns the CPE router in the customer's home, and this performs NAT. Some don't and allow the customer to have a box that just bridges the connections, where the customer can then choose their own equipment for NAT'ing (if they want that at all). In addition to this, some providers use CGN (also a form of address translation) within their own network. – jksoegaard Oct 18 '19 at 13:20
1

It turns out it's a Cisco AnyConnect feature called Web Security Addon.

Even though my Cisco VPN client was off this addon was still intercepting all my traffic and was sending it to that big brother service for inspection. It was pretty intrusive, even setting up a non-Cisco VPN or setting a Proxy in the network settings didn't stop it from interfering.

Fortunately I've got admin access on my MacBook so I was able to follow these instructions, removed /opt/cisco/anyconnect/bin/plugins/libacwebsec*, rebooted my Mac and now the network works as expected.

Hope this helps someone :)

MLu
  • 131