PLease help, going crazy! IP 239.255.255.250 over and over

Page 1 of 5 123 ... LastLast

  1. Posts : 17
    Windows 7 64 bit
       #1

    PLease help, going crazy! IP 239.255.255.250 over and over


    Ok, so this is a complicated question, and Im not too computer savvy, but Im hoping someone can help me.

    On my peerblock (I dont use p2p programs...although I used to) I keep seeing over and over again it blocking an IP named State of Connecticut239.255.255.250 , and I also see 224.0.0.251 from time to time. I disabled upnp, and ssdp. I even went and disabled the Mulicast IPv6, and it still shows up over and over. I try and ping those IP and it receives nothing.....which I assume it means it sending me something? Anyone have any clue what this is? Is this the SOC tracking me or something? Any insight would be greatly appreciated.

    Im using a VPN hotspotshield Win7 with peerblock on.

    ???
      My Computer


  2. Posts : 1,618
    Win7 Home Premium x64 W10Pro&Home
       #2

    Host Extensions for IP Multicasting [RFC1112] specifies the extensions
    required of a host implementation of the Internet Protocol (IP) to
    support multicasting. The multicast addresses are in the range
    224.0.0.0 through 239.255.255.255. Address assignments are listed below.

    The range of addresses between 224.0.0.0 and 224.0.0.255, inclusive,
    is reserved for the use of routing protocols and other low-level
    topology discovery or maintenance protocols, such as gateway discovery
    and group membership reporting. Multicast routers should not forward
    any multicast datagram with destination addresses in this range,
    regardless of its TTL.

    for more look here... http://www.iana.org/assignments/mult...-addresses.txt
      My Computer


  3. Posts : 17
    Windows 7 64 bit
    Thread Starter
       #3

    Thank you, but why does it say State of Connecticut? I also notice it on
    192.168.1.255. I see this literally 100's of times a day...please help
      My Computer


  4. Posts : 1,618
    Win7 Home Premium x64 W10Pro&Home
       #4

    these are NetBIOS requests, netbios is very old and has been replaced
    by dns and therefore can be disabled.

    In order to disable NetBIOS over TCP/IP you should go to
    Network and Sharing Center then change adapter settings. right click on your wireless and select Properties.
    Click on the ipv4 and then the properties button, advanced, go to the wins tab and disable tcp over netbios

    The only time that netbIOS needs to be left enabled is when there are
    computers on your network running older microsoft operating systems
    (anything before 2000, eg win 98, 95)
      My Computer


  5. Posts : 17
    Windows 7 64 bit
    Thread Starter
       #5

    I did this, but I still see it showing up over and over. What could this be? Is there a porgram on my computer doing this I can stop and find out what it is?
      My Computer


  6. Posts : 1,777
    MS Windows 7 Home Premium SP1 64-bit (Family Pack Lic.) Upgrade
       #6

    have you run any scans?


    192.168.1.255 = IANA (Internet Assigned Numbers Authority) - this address block is not broadcast by the IANA, but simply reserved - so you would not be receiving "credible" broadcasting served from this location.

    The other numbers may be trying to send to your network to aid in network location discovery and your system is stoping the outgoing packets (I guess it could be another computer on the network tx-ing, but that would be real easy to find out - disconnect them all but the one you speak of.) I read about something recently where a incorrect/spoofed routing table led to these local signals being sent out across the Internet, instead of looking for upup or printers and so on locally, (possibly by malicious software altering the routing tables?)

    any mention of port numbers?

    have you checked your hosts file. And no simply turning off TCP over NetBIOs will not stop NETBIOS BROADCASTING
    Last edited by rubyrubyroo; 29 Nov 2011 at 03:33. Reason: mistake
      My Computer


  7. Posts : 17
    Windows 7 64 bit
    Thread Starter
       #7

    Ok, I THINK I got it to stop ( at least for the past few hours after I disabled it), but does anyone have any idea WHY it would say State of Connecticut?! Does this mean a multicast on my machine is trying to send something to the SOC?!

    Ive seen it show up on port 1900 and 3702
      My Computer


  8. Posts : 1,777
    MS Windows 7 Home Premium SP1 64-bit (Family Pack Lic.) Upgrade
       #8

    I'll have to get back to you, im in the middle but 1900 port is what i was lookin for.... i'll return...give me a minute please

    mike
      My Computer


  9. Posts : 1,777
    MS Windows 7 Home Premium SP1 64-bit (Family Pack Lic.) Upgrade
       #9

    Okay...first of all: are, or were, the following services running at the time of the issue:
    1.) SSDP disc.
    2.) UPNP
      My Computer


  10. Posts : 1,777
    MS Windows 7 Home Premium SP1 64-bit (Family Pack Lic.) Upgrade
       #10

    the ports you mentioned are UDP UPNP ports - which means there's some process(es) on your system which are most likely not malicious, although I cant know for sure. But they are transmitting a message query intended for local network devices upnp's (such as a server, a printer, fax, etc) using the ip's you mentioned such as 239.255.255.250 and so on, so your computer detects this process trying to tx and stops it before it has a chance to get to your network, where you probably either no longer have the upnp's it's trying to reach, or it is just an artifact of unknown numerical origin! as for the SOC...1st off if you are as paranoid as you sound (to my trained ears/eyes) you sound like there might be a reason to be worried, no need to share, but it would tend to place more significance on the name. I suspect the IP that was intended to be used for entirely different purposes (like i said..local network com.) so the address would have a normal connection in the "Internet world" so it's probably in your DNS cache which you should flush, your hosts file which should be checked and kept up to date by your choice of methods (you sound like you can handle it, but I can get you some links to software and help you create a executable batch file that will automate much of the process. But I would stop, disable those two services and block the two ports as they are not necessary. No one is trying to find you or anything, for one because it would be such a crude and 95% failure rate prone, they would use a much more sophisticated method to hunt their prey. If the hosts and flushing do not stop the name, then the ip may simply belong to the SOC just like the other on I mentioned was a "sterile" or non transmitting/non receiving ip from IANA.

    Sincerely,
    :)Mike
    Last edited by rubyrubyroo; 26 Nov 2011 at 14:29.
      My Computer


 
Page 1 of 5 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 08:58.
Find Us