Strange Hostname on Private IP

[WaterGlobe43]

After looking over my firewall logs, I noticed that one
of my private IP address on my home network
(10.0.1.4) has a very strange host name
(cscslt72.cardiacstudycenter.com). At the time that I
noticed this, the IP address was used by an Airport
Express that was joined to the wireless network.
Can someone explain how this name got associated
with a private IP address?

1) how did this happened and 2) is it a security
issue?

What's explained here is about the extent of my networking knowledge. Please speak slowly.

Thanks for the help.

[Suncoast]

Do you have any security setup on your wireless access point? Like WEP or WPA? I'm thinking a portable wireless device connected to your wireless access point and accessed the Internet through your network connection.

[WaterGlobe43]

I use WPA2 and have my home network set to "closed." I guess it's possible someone could have found the network (I've read that part is easy) and then cracked my password, but it seems like alot of effort.

Also, If that's the case, then why would that IP that (10.0.1.4) be associated with one of my airport expresses? Wouldn't it be associated with either the laptop that broke in or nothing at all?

Not being argumentative. Just trying to understand.

Thanks.

[Suncoast]

No, you are correct. Since you're using WPA2, that isn't what's going on. And I though you meant the 10.0.1.0 network is yours. The 10.x.x.x network is considered private address space, and it's commonly used by ISP's. Is it possible the entry you see is an external host trying to hit your ISP facing firewall?

[WaterGlobe43]

You are correct. The 10.0.1.0 network is mine. Apple uses 10.0 instead of the 192.168 numbers. When I look at my firewall log, all other machines on my network just repeat the private IP for the "Host Name." But for some reason, 10.0.1.4 has the weird host name that appears to come from an external source.

I know that my ISP uses the 10.x.x.x. Maybe somehow the router got "confused" (very technical) and searched the ISP for a 10.x.x.x host name for something on my private network? I don't even know if that makes sense.

[Suncoast]

Quite Interesting. To answer your original question, It's not a security risk. It just means when your system does a reverse lookup for that IP address, it's getting an answer from somewhere that it's name is cscslt72.etc.

[WaterGlobe43]

Thanks for the help Suncoast. Just a followup....

When my system does the reverse lookup for that IP, where excatly does it get the info from? Is it from my ISP? or is it from my router (since it's a private/local IP address)?

The 10.0.1.4 address has been reassigned to another device in the last few days, but it still show the same weird host name. So I'm just trying to figure out where the "bad info" is coming from... if it's from router/modem or something inside my network, or if somehow my ISP thinks that 10.0.1.4 is a public IP and returning the weird host name.

[Suncoast]

That's the part I found interesting. The router (Access Point) is getting the DNS settings from the ISP as part of its DHCP lease. So unless you've manually set it to a different DNS server, it's coming from the ISP. So even if you have your own DNS server, the router will still be doing lookups from the ISP's in-addr-arpa records.

[WaterGlobe43]

Ok. The last post officially went over my head. But from what I can tell, in laymen's terms, the odd host name is coming form my ISP and has nothing to do with any settings on my home network. Since this is the case, I have no way of correcting/changing the bad host name - it's something that's all on the ISP end of things. Correct?

Out of curiosity, does this mean that every person using my ISP who has a home network that uses 10.0.x.x (as opposed to 192.168) will show that same wacky host name for whatever device is assigned to 10.0.1.4? So if the folks down the street have an apple setup and 4 or more devices, then they will also show that same strange host name for 10.0.1.4?

Thanks for your patience. At this point, I'm not so much worried about security, but just curious and trying to understand what the deal is.

[Suncoast]

Sorry about that. I have a fever, got sick yesterday. So I'm a little off today.

No, it's not you. It's the ISP. The only easy way you can get it out of there is to change the IP address of the Airport Express. Or a little more complicated, you could change your DNS server settings to opendns.org on the Airport. There is an instruction page here.

Originally Posted by WaterGlobe43

Out of curiosity, does this mean that every person using my ISP who has a home network that uses 10.0.x.x (as opposed to 192.168) will show that same wacky host name for whatever device is assigned to 10.0.1.4? So if the folks down the street have an apple setup and 4 or more devices, then they will also show that same strange host name for 10.0.1.4?

Yep, it does. I also find it interesting that someone has not pointed it out to the ISP before, since from what I learned from you this is standard Apple addressing.