DHCP Request?

April 11, 2006 at 19:02:36
Specs: XP Pro v2002 SP2, P3 866MHz / 384MB

It seems that all day, every day, my router is being requested by some foreign IP address. I have no idea what's going on, whether this is just an internal process or whether some really determined hacker is trying to access my network... all day. Every once in a while, there's a "DHCP request success" thrown in there, as well.

I have a D-Link DI-524 wireless router, but the wireless portion is turned OFF. Here is what the log looks like. It's the same IP address every single time. Thoughts?

http://img133.imageshack.us/img133/8002/request3gl.jpg

Just to clarify, that IP address is not mine or anywhere close to it. It doesn't even have the same range as any of my networked machines or the router itself.


See More: DHCP Request?

Report •


#1
April 11, 2006 at 20:08:49

looks like a unconfigured switch or network device, to me, requesting a ip address.

What happens when you ping that ip?

Give a person a fish you feed them for a day.
Ask a person to internet search and they learn a skill for a lifetime.


Report •

#2
April 11, 2006 at 22:07:44

Hmm. While browsing around the menus of status information on my router, I found that the IP address of my WAN is one and the same with the one that is requesting DHCP. So, this means that the 24.222.x.x address is the IP address of my cable modem, correct?

If so, are the constant requests normal, or is this a problem?

Ping statistics for 24.222.x.x:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms


Report •

#3
April 12, 2006 at 06:58:02

"So, this means that the 24.222.x.x address is the IP address of my cable modem, correct?"

No, your modem does not get an IP from your router. If the IP that keeps making the request is on the same WAN as you, it sounds as if either this is something your ISP is doing (knowingly or not) or it is something that another subscriber with your ISP is doing (again knowingly or not).

Worst case scenario is that another subscriber on your network is trying to hack into your computer. I suggest you contact your ISP and have them follow up.

Michael J


Report •

Related Solutions

#4
April 13, 2006 at 09:49:26

I called up my ISP and asked what was up. The tech didn't think that the requests had anything to do with an individual within the ISP, and was convinced that it was their DHCP server that was causing the problem.

He suggested I disconnect my router for a day, since he cannot see the logs on his end if I connect through a router (?). So I did, and I'll call them back tomorrow.

But here's something funky as well. You'll see in my first post I emphasized strongly that my wireless was disabled? Well yesterday a neighbour of mine connected to it. I promptly kicked him off. I went to the settings to see how the uplink was possible, and the wireless was enabled. I am 100% sure it was off and I am 100% sure I didn't turn it on. I am the only one with access to this router. Am I just being paranoid?


Report •

#5
April 13, 2006 at 10:21:34

"Am I just being paranoid?"

No, just cautious. You say you were 100% it was turned off. There could be a few explanations: 1) When you clicked the setting to turn it off, perhaps you closed the web interface or went to another property page without "applying" the changes, 2) perhaps the router was reset at some point in time to factory defaults? or 3) you (or someone else) changed that setting.

You should change your password for your router to a very strong password. And, if you don't need it, ensure that remote administration is disabled. It may be listed under a different name, but it is the setting that allows connections from the internet to administrate your router.

By the way, your ISP should be able to know exactly where those requests were coming from based upon the IP address making the request. Perhaps the "DHCP request success" is your router making a DHCP request from your IP and this is nothing to be worried about. And, if it is coming from another subscriber, it may be unintentional. They may be infected with something that is trying to access network resources.

Michael J


Report •


Ask Question