PLease help, going crazy! IP 239.255.255.250 over and over

Host Extensions for IP Multicasting [RFC1112] specifies the extensions
required of a host implementation of the Internet Protocol (IP) to
support multicasting. The multicast addresses are in the range
224.0.0.0 through 239.255.255.255. Address assignments are listed below.

The range of addresses between 224.0.0.0 and 224.0.0.255, inclusive,
is reserved for the use of routing protocols and other low-level
topology discovery or maintenance protocols, such as gateway discovery
and group membership reporting. Multicast routers should not forward
any multicast datagram with destination addresses in this range,
regardless of its TTL.

for more look here... http://www.iana.org/assignments/mult...-addresses.txt

these are NetBIOS requests, netbios is very old and has been replaced
by dns and therefore can be disabled.

In order to disable NetBIOS over TCP/IP you should go to
Network and Sharing Center then change adapter settings. right click on your wireless and select Properties.
Click on the ipv4 and then the properties button, advanced, go to the wins tab and disable tcp over netbios

The only time that netbIOS needs to be left enabled is when there are
computers on your network running older microsoft operating systems
(anything before 2000, eg win 98, 95)

have you run any scans?


192.168.1.255 = IANA (Internet Assigned Numbers Authority) - this address block is not broadcast by the IANA, but simply reserved - so you would not be receiving "credible" broadcasting served from this location.

The other numbers may be trying to send to your network to aid in network location discovery and your system is stoping the outgoing packets (I guess it could be another computer on the network tx-ing, but that would be real easy to find out - disconnect them all but the one you speak of.) I read about something recently where a incorrect/spoofed routing table led to these local signals being sent out across the Internet, instead of looking for upup or printers and so on locally, (possibly by malicious software altering the routing tables?)

any mention of port numbers?

have you checked your hosts file. And no simply turning off TCP over NetBIOs will not stop NETBIOS BROADCASTING

the ports you mentioned are UDP UPNP ports - which means there's some process(es) on your system which are most likely not malicious, although I cant know for sure. But they are transmitting a message query intended for local network devices upnp's (such as a server, a printer, fax, etc) using the ip's you mentioned such as 239.255.255.250 and so on, so your computer detects this process trying to tx and stops it before it has a chance to get to your network, where you probably either no longer have the upnp's it's trying to reach, or it is just an artifact of unknown numerical origin! as for the SOC...1st off if you are as paranoid as you sound (to my trained ears/eyes) you sound like there might be a reason to be worried, no need to share, but it would tend to place more significance on the name. I suspect the IP that was intended to be used for entirely different purposes (like i said..local network com.) so the address would have a normal connection in the "Internet world" so it's probably in your DNS cache which you should flush, your hosts file which should be checked and kept up to date by your choice of methods (you sound like you can handle it, but I can get you some links to software and help you create a executable batch file that will automate much of the process. But I would stop, disable those two services and block the two ports as they are not necessary. No one is trying to find you or anything, for one because it would be such a crude and 95% failure rate prone, they would use a much more sophisticated method to hunt their prey. If the hosts and flushing do not stop the name, then the ip may simply belong to the SOC just like the other on I mentioned was a "sterile" or non transmitting/non receiving ip from IANA.

Sincerely,
:)Mike