New private network available - 169.254.187.57

General Discussion (off topic) Anything and everyt
#1

I have a router that makes my LAN set up to the [10.0.0.0 - 10.0.0.255] range.
I believe 10.0.0.0 is the “ISP PC”, and 10.0.0.1 being my router itself.
A while ago, I suddenly got pop-ups from Comodo Firewall telling that there was a new private network available; 169.254.187.57.
At first I just told no, I don’t want to use it.
But I got curious after a while, so I started up Wireshark, and then when I checked the MAC address of the connection,
I saw that it was the one belonging to my neighbor’s laptop (I have given her the WPA password and added the MAC to the MAC filter of my router.)

So… the big question is… WHY does this happen?
She had been using my net for a long while before this.
It started happening… at least several months ago, maybe as much as a year.
It still continues even after she have bought a new laptop.

The only possible clues I have found, was some info that is now not visible on www.robtex.com anymore, but still visible on this page here
http://www.sitetrail.com/fbt.com.tw

  • almost at the bottom, in the DNS Record Analysis:
    It says that fbt.com.tw has 3 different A records,
    where the last of them is indeed one that belongs to a private network; 192.168.1.4
    My pc’s local IP is 10.0.0.3, my neighbor’s local IP (on MY LAN, that is!) is 10.0.0.9.

After speculating a lot… I came up with a weird thought:
what if my neighbor’s IP at the time immediately after she turns on her laptop
(that is, before she has connected with the WiFi to my router and got her IP from it) is 192.168.1.4
…and that that IP is somewhat… “double-reversed” into 169.254.187.57…?
Like 192.168.1.4 = fbt.com.tw,
then fbt.com.tw = 169.254.187.57

After I clicked “No I don’t wanna use this new private network” I then got questions about
“svchost.exe is trying to receive a connection from the Internet”

  • which was again this 169.254.187.57, and port 2869…
    (Firewall Security Level = Custom Policy)

I have sat up “Media Streaming is on” in
Control Panel > All Control Panel Items > Network and Sharing Center > Advanced sharing settings
And, when my neighbor’s laptop have the correct 10.0.0.9 local IP assigned,
I also get a lot of those port 2869 connections from her.
So I have a rule for svchost.exe to accept port 2869 to/from all my local IP ranges;
0.0.0.0 and [10.0.0.0 - 10.0.0.255] and [127.0.0.0 - 127.0.0.255]

It’s not an annoyance for me anymore…
…I made global rules in Comodo Firewall, blocking connections from/to 169.254.187.57.

Still, I wonder why this happens?
Have any of you experience with this?

#2

Perhaps this and this can help you understand this one.

#3

Thank you very much! :slight_smile:

Ah… so that was what it was, just another reserved range…
…and no “double-reversing”, just 169.254 plus two pseudo-random octets.

Hmm… when I tried looking up 169.254.187.57 that time, I seem to recall I found info that said something like
“…this IP belongs to a host located at…” and some actual location.
Kind of like that http://www.sitetrail.com/fbt.com.tw which claims it is located at Washington, District of Columbia, United States.
So that was maybe just some old info based on some misconfiguration of DNS’es - like that fbt.com.tw
Or maybe it was like “Houston, TX, USA” - which I now understand was just being the location of IANA itself.

#4

When a computer gets an IP address in the 169.254 range it means it cannot obtain an IP address from the DHCP server. Your neighbour’s laptop may not be able to connect to the web. It may a problem with the networking on her system.

When sharing a network with a third person whose computer you don’t have full control over, as opposed to computer in your house, I recommend to not trust the local network or only the computers in your house.