traceroute

Hi,

That is completely normal and expected.

The response is the IP that sends back to you, so it will be the LAN side address

If it gave both, you'd think there were two devices, rather than just the one that is actually there.

Alan.

Is this common situation with traceroute or what is the theory behind this ?

Perfectly normal, especially on a smaller network. There are cases where you might several LAN addresses, but that gets into networks with higher levels of complexity.

With traceroute , Router's LAN IP 10.xxx.xx.1 is getting listed as the first hop...

You're starting from inside the LAN, so the first response will be from the gateway address, which is 10.xxx.xx.1.

... and next is ISP GW IP

You're probably wondering why this is the case. Remember that 10.xxx.xx.1 and your WAN address are both tied to the same device. All that is happening is that the ICMP packet is reaching your firewall's LAN interface, and is passing the packet along through its WAN interface. Think of passing an object along people in a line. They might receive it in their right hand, and pass along with their left. For tracking purposes, you only pay attention to you passed the object to the person to your left, who passed to the person to their left. You never make a record of the fact that it moved from their right hand to their left. Unnecessary detail, as you know what direction it moved. So in this case, seeing the ISP GW address, you know that the packet went through the WAN interface to the ISP.