tapping into the brain power here

[CCMUA2009]

This doesn't really pertain to malwarebytes upfront, but

I have DSL set up configured phone line to dsl box to desktop

My IP address changes peiodically when I have been off the internet for any period of time.

So say currently my IP is 68.142.213.142 (not my real IP)

when I reboot my computer, I notice that my firewall shows port blocking allowed

68.142.213.255(3)

This will register in the activity log maybe 5-6 times within a 60 second period during the boot up process

Anyone know what this means? and why it happens sometimes?

Does it appear to be some type of infection? after boot up I run a scan with Norton, SpyBot and malwarebytes and nothing is detected

[GT500]

It's more likely that it's the DNS server from your ISP, and your computer is syncing it's table of which domains names map to which IP addresses.

[GT500]

Although, according to the hpHosts database, it's an Inktomi server...

http://hosts-file.net/default.asp?s=68.142.213.255

[CCMUA2009]

Oh the ip address I used here is not actually mine, I think it is for symantec or microsoft. i wasing going to post my IP here. I just used this as an example.

[CCMUA2009]

GT500 what do you mean when you say:

It's more likely that it's the DNS server from your ISP, and your computer is syncing it's table of which domains names map to which IP addresses

[GT500]

Oh the ip address I used here is not actually mine, I think it is for symantec or microsoft. i wasing going to post my IP here. I just used this as an example.

I know. As a moderator I can see your real IP address, and not even the first octet are the same.

GT500 what do you mean when you say:

It's more likely that it's the DNS server from your ISP, and your computer is syncing it's table of which domains names map to which IP addresses

http://en.wikipedia.org/wiki/Domain_name_system

[CCMUA2009]

Now interestingly, I had turned off my computer for 3-4 hours. When I rebooted, I received a new IP address

68.124.210.89 (again not my real IP)

But this time there were no entries that indicated my firewall allowed similar IP address with 255 ending

example-

68.124.210.255 (3)

So as I noted before, it seems to happen on Friday's and Saturdays and only when I may have had the IP address for less than 24 hours

So this additional information lend support that the IP addresses coming through teh firewall with teh .255 ending ARE NOT anything to be concerned about?

[GT500]

That IP address looks like it resolves to an old Pacific Bell server registered to AT&T.

http://hosts-file.net/default.asp?s=68.124.210.89

You may want to run something like TCPView, and see if you can catch what is making these connections.

[CCMUA2009]

Thanks all. The specific IP address that I note here is not my real IP address. So I'm not concerned as to where it comes from. I am using it illustrate my question about why would an IP address similar to mine, but ending in .255 be coming through my firewall at port 3?

Then I noticed this happens more on Friday and Saturday . So again, just wondering why if my IP Address were 68.124.210.89 would I see an ip address 68.124.210.255 coming into my system

[marktreg]

It's nothing to be concerned about. The 255 replacing the usual numbers at the end of your own IP (Network) address is what's known as your 'broadcast address'. A 'broadcast address' allows information to be received by all the devices on a network instead of just one. It's quite complicated to explain, so if you want to know more, see what you can find on Google about "Subnetting", "Subnet Mask" and "broadcast address".

[GT500]

... So again, just wondering why if my IP Address were 68.124.210.89 would I see an ip address 68.124.210.255 coming into my system

Your real IP address doesn't end in .89... Or is that another example?

[CCMUA2009]

GT500- its another example. Would think it not prudent to give my real IP address

[CCMUA2009]

marktreg-

you said "A 'broadcast address' allows information to be received by all the devices on a network instead of just one"

Now I only have 1 computer so what, in this instance is meant by "all the devices on a network " ?

all the computers assigne an address in that IP range by my ISP?

[CCMUA2009]

marktreg-

you said "A 'broadcast address' allows information to be received by all the devices on a network instead of just one"

Now I only have 1 computer so what, in this instance is meant by "all the devices on a network " ?

all the computers assigned an address in that IP range by my ISP?

[CCMUA2009]

sorry for the double post. Don't know how to delete the first one after I tried to correct my spelling error

[marktreg]

Let's try to clarify this a bit. Does the 'IP Address' you are seeing with 255 at the end start with 192.168?

[CCMUA2009]

No it does not start with 192.168

as I say if my assigned IP address by my ISP is Example 68.124.210.89, would I see an ip address 68.124.210.255 being allowed through my port, mostly at boot up (though it might show sometimes 1 or 2 times within the next 12 hours)

[CCMUA2009]

I know 192.168 has to do with teh DSL box, but as I say the IP addressending in 255 is similar to my IP address assigned by my ISP

[CCMUA2009]

maybe I can clarify a little bit (Again all the IP addresses I use in this example are fake, just to illustrate)

lets say my IP address assigned by my ISP is

67.123.45.67

So I reboot on a Friday or Saturday. My IP stays the same because I just rebooted. But then on reboot I notice in teh firwall log that an IP address similar to mine (above) but ending in 255 rather than 67, shows up being allowed during boot up

But my IP still stays 67.123.45.67, there is just another similar one 67.123.45.255 coming through my firewall

Now lets say I have IP address 67.123.45.67, then on a Wednesday I shut off my computer for several hours. the upon start up I get a new IP address because I have not used mine for over sevral hours. So my new IP address is now

56.234.56.170

now during this start up time, I get NO 56.234.56.255 showing up in my firewall log.

But then I reboot on a saturday and I get the 56.234.56.255 in the firewall log

so the question really is does the IP address ending in .255 is it coming from my ISP and does it have a reason why it happens on Friday and Saturday as opposed to Monday or Tuesday? Is it something to do with my ISP?

[screen317]

It just means your ISP gives dynamic IP addresses... If your ISP is AT&T DSL, then that's normal...

[CCMUA2009]

I understand that my Ip changes and gets a new IP assigned by my ISP

Ok but here is where I'm stuck, it doesn't change my IP when the Ip ending in 255 comes through the port. that is what I'm really trying to find out, what is this IP ending in 255 and why does it come into my computer?.

[exile360]

The 255 IP should be your default gateway or subnet mask, which won't change as it comes from your router/modem. You can verify this by doing the following:

• Click Start and select Run
  
• Type cmd and press Enter or click on OK
  
• In the black command prompt window type the following and press Enter:
  

  ipconfig

  
  

• Review the entries listed (I'd recommend not posting them in a public forum)
  

[AdvancedSetup]

Normally if you're on a router then that won't show you your outside IP either. Only if you're directly connected.

You would need to access the router to obtain your outside IP numbers or visit a site like whatsmyip.net to see the real IP that others see you as.

[marktreg]

Sorry, I forgot about this thread. If your IP address started with 192.168, it would have been your Private Network Address that your router had assigned to your particular computer on the network. But, as it's your actual IP address that has 255 as the last octet, the explanation is not the same. In a Class C IP address, which is what you will have, the first three octets make up the Network Address and the last octet is the Host Address. ISP's obtain blocks of Network Addresses from the Internet Network Information Center (InterNIC) and then they assign the user his own Host Address on that particular network. So there could be 200 or more IP addresses where the first three octets are the same but differ only in the last octet. What is happening is what GT500 has already said. i.e. It's the DNS server from your ISP, and your computer is syncing it's table of which domains names map to which IP addresses. And, instead of using individual IP addresses, the DNS server puts 255 after the first three octets which means that it will automatically reach every Host Address on that particular network. That is why IP addresses with 255 at the end are called Broadcast Addresses. So, to sum up, it's not anything to worry about.