Detecting two different networks

Hello
When i log on internet for the first time after i installed firewall i get notified about im joining two different networks one is in the ip 169 range, and the other is in 192 range. Both are on different ports. I cannot trace any of them. This happens both before and after i did format harddrive.
My connection is a wired one and im using Thomson TMC420 cable modem. I wonder why im joining two different networks, when im not using a router. Is someone hacking me?

I would guess your modem is also a NAT/router, which allows you to have a private network on one side and the Internet on the other. The 192.168.x.x/255.255.255.0 address range is a for private networks, such as small LANs. If you open a command prompt and type:

ipconfig /all

I’m sure you’ll see your IPv4 address is from this range.

The 169.254.x.x/255.255.0.0 address is called an APIPA address (Automatic Private IP Address). Addresses from this range are allocated by the Operating System when a DHCP server - your modem - is temporarily unavailable.

I thought DHCP servers was assigned by my ISP.
My ipv4 address is traced to one part of my country and the dhcp address i see in ipconfig /all is from a different place in my country.
So when i can ping the dhcp server it must be in use?

That depends on the functionality of your modem.

My ipv4 address is traced to one part of my country and the dhcp address i see in ipconfig /all is from a different place in my country.

Is your ISP in a different part of the country from you?

So when i can ping the dhcp server it must be in use?

I did say “temporarily unavailable” it could simply be a matter of seconds when the DHCP client attempts to contact a DHCP server and for what ever reason, it fails to respond.

You should take a look at the documentation for your modem, it should tell you what it’s capable of. If you want, you can post the results of your ipconfig /all here.

Its strange it detects two networks now i have used comodo firewall for years and only recently after i had problems with virus and had to format harddrive its been detecting two networks.
And its not just once in a while its every time i connect.

Yes my ISP is in capital city, not where i live.

How safe is it posting ipconfig log on forum showing mac address?
Cant i just send it to you?

If you’re worried about security, you can PM me the details.

Thanks for the PM.

The ipconfig you sent shows you have a public IP address, which is curious, considering the private network IP address block (192.168.x.x) mentioned. I can only imagine this has something to do with your Thomson TMC420. I did have a quick look for a manual, but came up empty. Apparently, it does have some sort of built in firewall and it’s accessible from an admin page, but you’ll have to check the documentation to find out how.

For your information, the network detection capability of CIS is based on the IP address it detects allocated to the system, on which it’s installed. Bearing that in mind, your PC must be getting a 192 address from somewhere, for it to be detected. If it’s not coming from the Thomson, the only other thing I can think of is wireless, from somewhere. Does your PC have a wireless adapter?

No i have no wireless adapter only usb adapter for the dlink router which ive not used for years. And the adapter is unplugged. The only nic i have is Realtek PCIe GBE Family Controller.

Then you need to check the documentation for your Thomson.

All i can find is this:
www.mmn.hu/doc/Technicolor%20TCM420.pdf
Also i got no documentation or cdrom when box was installed.

You can take a look at the products listed at Technicolor Partner Hub. I couldn’t find your model but reading several of the other manuals, they all indicate the administrative web interface for the device, is at 192.168.1.254. To access that, you may have to manually alter the IP address settings from dynamic to static on your PC. Give yourself an address like 192.168.1.10 with a mask of 255.255.255.0. Once done, enter 192.168.1.254 in the address bar of your browser and see what happens.

When i do that i get unidentified network under network configuration and lose connection.

I really hate that can’t identify unidentified network and loss of connection, finding a new public one when I only have a private setting in Windows, PITA.

This thread interests me because similarly I’ve had to swipe my system drives several times after getting some infection and also seeing more than one ‘connection’ or having that ‘found new public network’ thing happen and cut off of my internet…

This will happen until you can connect to you modem and find out more about the configuration. Loosing the Internet connection is only temporary, whilst you try and investigate.

I found it.
192.168.100.1
Also found modem manual: http://www.opweb.de/model.php?id=427

Well done. Now all you need to do is log on to the device and see what it has to offer.

192.168.100.1 is one of the two networks im joining when logging on, so i had to make a rule in firewall to access interface. The other network 169.254.18.65 im not able to do this with.
So heres whats on the interface screen:

MAIN:
PC Connectivity
USB
Ethernet
USB VendID
MAC Address

Cable Signal
Tuning
Ranging
Data Service
Connecting
Configuring
Registering

Current State
Highest State Obtained

Configuration Parameters
Computers Allowed by Service Provider
Computers Detected by Modem

DIAGNOSTICS:
MODEM TECHNICAL DETAILS STATUS PAGE

Status Code
Software Version
Software Model
Bootloader

Cable Signal Details
Forward Path
Signal Acquired at
SNR
Received Signal Strength
Bit Error Rate
Modulation

Return Path
Connection
Frequency
Power Level
Channel ID
Modulation

Data Service Details
Provisioned Address
Provisioned Time
Provisioned Configuration
Registered
BPI

EVENT LOG:

Time Priority Description
Time Not Established Critical (3) DHCP WARNING - Non-critical field invalid in response.
Time Not Established Critical (3) No Ranging Response received - T3 time-out
Time Not Established Critical (3) DHCP WARNING - Non-critical field invalid in response.
Thu Feb 23 18:07:33 2012 Critical (3) Received Response to Broadcast Maintenance Request, But no Un…
Time Not Established Critical (3) DHCP WARNING - Non-critical field invalid in response.
Time Not Established Critical (3) No Ranging Response received - T3 time-out
Time Not Established Critical (3) DHCP WARNING - Non-critical field invalid in response.
Time Not Established Critical (3) No Ranging Response received - T3 time-out
Time Not Established Critical (3) No UCD’s Received - Timeout
Thu Feb 23 18:15:32 2012 Critical (3) SYNC Timing Synchronization failure - Failed to acquire QAM/Q…
Thu Feb 23 18:15:20 2012 Critical (3) SYNC Timing Synchronization failure - Failed to acquire FEC f…

INITIAL SCAN:

SET INITIAL SCAN FREQUENCY SETUP

Enter the initial downstream scan frequency:
To speed up the modem’s first time startup, enter known downstream frequency and/or upstream channel ID information here. Then click the ‘Set Values and Reboot’ button. The modem will start scanning the cable network beginning with the values supplied here.

Initial Downstream Frequency
    This is the frequency of the first downstream channel that will be tried.
    The frequency units are in Hz. E.g., enter 555000000 for 555 MHz.

Initial Upstream Channel ID
    This is the channel ID of the first upstream channel that will be tried.

I don’t see anything obvious in there but without going through the settings in detail, it’s difficult to say. To be honest, the mere fact that the modem has an interface accessible via a 192.168.x.x reserved address, may be the reason the network is being detected.

As this is a private address range, with the modem as the most likely source, you can simply allow the zone to be created. Doing so will add rules to the System process in Application rules and to Global rules, but you can delete those and just leave the zone. Doing so is not a security risk.