Who's IP is this?

**Admin** · 11-Jan-2007, 10:55 PM

ZoneAlarm security suite detected a new network with IP 169.254.0.0/255.255.0.0 and wants me to name it and pick a internet zone. Is this a IP my router gave to something on my network ( Im running DHCP with 3 workstations, print sever and network storage link )) or is this a remote computer trying to connect to my workgroup?

POssible Solutions:

That IP is one assigned automatically by your computer when it can't get one from a router/dhcp or from the computer's settings. It is not an external computer and doesn't mean your computer is exposed, etc. ZoneAlarm is just providing that message because it is a new "network." However that IP is in the private, automatic assigned range and wouldn't even work in most intranets, much less for Internet use.

Solution 2 :

From arin:

whois 169.254.0.0@whois.arin.net
[whois.arin.net]

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 169.254.0.0 - 169.254.255.255
CIDR: 169.254.0.0/16
NetName: LINKLOCAL
NetHandle: NET-169-254-0-0-1
Parent: NET-169-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: Please see RFC 3330 for additional information.
RegDate: 1998-01-27
Updated: 2002-10-14

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: abuse@iana.org

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: abuse@iana.org

# ARIN WHOIS database, last updated 2006-10-24 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

From RFC 3330:

169.254.0.0/16 - This is the "link local" block. It is allocated for
communication between hosts on a single link. Hosts obtain these
addresses by auto-configuration, such as when a DHCP server may not
be found.

So, some computer (probably a windoze box) assigned itself an IP since apparently it did not have a statically configured IP and was not able to receive an assignment via DHCP.

**tijnema** · 16-Jan-2007, 02:25 AM

to detect if it's a computer in your network, plug out internet from your router/modem, then ping the IP

11-Jan-2007, 10:55 PM	#1 (permalink)
Admin Administrator Posts: 875 Join Date: Oct 2005 Rep Power: 10 IM:	Who's IP is this? ZoneAlarm security suite detected a new network with IP 169.254.0.0/255.255.0.0 and wants me to name it and pick a internet zone. Is this a IP my router gave to something on my network ( Im running DHCP with 3 workstations, print sever and network storage link )) or is this a remote computer trying to connect to my workgroup? POssible Solutions: That IP is one assigned automatically by your computer when it can't get one from a router/dhcp or from the computer's settings. It is not an external computer and doesn't mean your computer is exposed, etc. ZoneAlarm is just providing that message because it is a new "network." However that IP is in the private, automatic assigned range and wouldn't even work in most intranets, much less for Internet use. Solution 2 : From arin: whois 169.254.0.0@whois.arin.net [whois.arin.net] OrgName: Internet Assigned Numbers Authority OrgID: IANA Address: 4676 Admiralty Way, Suite 330 City: Marina del Rey StateProv: CA PostalCode: 90292-6695 Country: US NetRange: 169.254.0.0 - 169.254.255.255 CIDR: 169.254.0.0/16 NetName: LINKLOCAL NetHandle: NET-169-254-0-0-1 Parent: NET-169-0-0-0-0 NetType: IANA Special Use NameServer: BLACKHOLE-1.IANA.ORG NameServer: BLACKHOLE-2.IANA.ORG Comment: Please see RFC 3330 for additional information. RegDate: 1998-01-27 Updated: 2002-10-14 OrgAbuseHandle: IANA-IP-ARIN OrgAbuseName: Internet Corporation for Assigned Names and Number OrgAbusePhone: +1-310-301-5820 OrgAbuseEmail: abuse@iana.org OrgTechHandle: IANA-IP-ARIN OrgTechName: Internet Corporation for Assigned Names and Number OrgTechPhone: +1-310-301-5820 OrgTechEmail: abuse@iana.org # ARIN WHOIS database, last updated 2006-10-24 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. From RFC 3330: 169.254.0.0/16 - This is the "link local" block. It is allocated for communication between hosts on a single link. Hosts obtain these addresses by auto-configuration, such as when a DHCP server may not be found. So, some computer (probably a windoze box) assigned itself an IP since apparently it did not have a statically configured IP and was not able to receive an assignment via DHCP.

16-Jan-2007, 02:25 AM	#2 (permalink)
tijnema Administrator Posts: 321 Join Date: Jan 2006 Rep Power: 10 IM:	Re: Who's IP is this? to detect if it's a computer in your network, plug out internet from your router/modem, then ping the IP ------------------ 2oo7

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)