blocked address

gorkin wrote:

> Hi! I got these port scans from ip 169.254.144.251 and when i tried to do
> traceroute it said assigned by IANA for use in private internets
> [blocked]...what the hell does this mean?...i also tried pinging whois etc
> etc using various sites online offerring this kind of stuff...all I found
> out is that they have their ports 80 and 53 (UDP) open...
>
> thanks.

I just ran that IP through samspade.org and it shows as belonging to the
IANA. It looks like it might be part of a blackhole list system that they
maintain. Do you have a mail server running at the address that got
scanned? If so, you may want to check if it got 'blacklisted'. Some of
the blackhole systems will run port scans when they suspect open relays.

John

gorkin wrote:

> Hi! I got these port scans from ip 169.254.144.251 and when i tried to do
> traceroute it said assigned by IANA for use in private internets
> [blocked]...what the hell does this mean?...i also tried pinging whois etc
> etc using various sites online offerring this kind of stuff...all I found
> out is that they have their ports 80 and 53 (UDP) open...
>
> thanks.
>
>
169.254.x.x is indeed a private ip. It's what a Windows machine will
get if there is no dhcp server and it's trying to contact one.
Therefore, the machine must be on your local network - try following
your network cable.

--
Richard Kirkcaldy


http://lordrich.com

Richard Kirkcaldy

"gorkin" said in news:c1ip32$23tk$:
> Hi! I got these port scans from ip 169.254.144.251 and when i tried
> to do traceroute it said assigned by IANA for use in private internets
> [blocked]...what the hell does this mean?...i also tried pinging
> whois etc etc using various sites online offerring this kind of
> stuff...all I found out is that they have their ports 80 and 53 (UDP)
> open...
>
> thanks.


APIPA

Short for Automatic Private IP Addressing, a feature of later Windows
operating systems. With APIPA, DHCP clients can automatically self-configure
an IP address and subnet mask when a DHCP server isn't available. When a
DHCP client boots up, it first looks for a DHCP server in order to obtain an
IP address and subnet mask. If the client is unable to find the information,
it uses APIPA to automatically configure itself with an IP address from a
range that has been reserved especially for Microsoft. The IP address range
is 169.254.0.1 through 169.254.255.254. The client also configures itself
with a default class B subnet mask of 255.255.0.0. A client uses the
self-configured IP address until a DHCP server becomes available.
The APIPA service also checks regularly for the presence of a DHCP server
(every five minutes, according to Microsoft). If it detects a DHCP server on
the network, APIPA stops, and the DHCP server replaces the APIPA networking
addresses with dynamically assigned addresses.

APIPA is meant for nonrouted small business environments, usually less than
25 clients.


--
__________________________________________________ __________
*** Post replies to newsgroup. E-mail is not accepted. ***
__________________________________________________ __________

*Vanguard*

On Wed, 25 Feb 2004 20:28:55 -0800, "gorkin" <>
wrote:

>Hi! I got these port scans from ip 169.254.144.251 and when i tried to do
>traceroute it said assigned by IANA for use in private internets
>[blocked]...what the hell does this mean?...i also tried pinging whois etc
>etc using various sites online offerring this kind of stuff...all I found
>out is that they have their ports 80 and 53 (UDP) open...
>
>thanks.

Its a default address that a PC on your network has assumed because
it has not been allocated one by a DHCP server;

It happens a lot if the network card is not properly configured
and the machine is half on and half off a network.

Extract from RFC 3330 ...

169.254.0.0/16 - This is the "link local" block. It is allocated for
communication between hosts on a single link. Hosts obtain these
addresses by auto-configuration, such as when a DHCP server may not
be found.


--
Jim Watt http://www.gibnet.com

Jim Watt

Hi! I got these port scans from ip 169.254.144.251 and when i tried to do
traceroute it said assigned by IANA for use in private internets
[blocked]...what the hell does this mean?...i also tried pinging whois etc
etc using various sites online offerring this kind of stuff...all I found
out is that they have their ports 80 and 53 (UDP) open...

thanks.

gorkin