calling all network experts / hacking experts

[cypher_soundz]

Hi,
I was just on my pc , when my software firewall/ad blocker told me about a new network that had been detected! Alarm bells started going off in my head as I have a router connected to the Internet, which is also a firewall. So I block the connection and I could not connect to the net, I tried logging in to my router but my password had been changed!
I try resetting the router and in the end I get back on-line, I previously wrote down the IP address and thought I would take a look at who it was, it came from a company called Http://www.IANA.ORG which "educated to preserving the central coordinating functions of the global Internet for the public good." hmm ok why are they trying to log on to my network? I noticed that my network card was set to the IP before I reset it. I little puzzled I did a whois on my current IP ...it is from Amsterdam (not were I am from) and running under the RIPE Network Coordination Centre. Should I be worried of hacking etc? Or is there some type of logical explanation? It seems my ISP is not registered on any whois???
:confused:
Please give me some insight and help ANY SUGGESTIONS Will be warmly welcomed!
Regards
Cyph

EDIT: Sorry using ripe it does come up as my ISP , but the other IP is still under the IANA!

[Doom9]

Alright.. first calm down, there seems to be a natural explanation for this.

Software firewalls can sometimes be tricky. For instance, you have a DHCP problem (router froze up, or whatnot) and Windows gives you a 169.x IP. Boom... you got a new network and your software firewall will ask you to authorize any connections on it. Or, you switch the router (I recently did that) and then you end up with warnings even though nothing really has changed IP wise, your gateway and DHCP server is still the same.

As for passwords.. how many times have I wondered why the heck my password didn't work anymore, just to realize that I had changed it before but couldn't remember that I had changed it anymore. Unless you manually overrode the standard rules (well.. I do very much hope that non Zyxel providers also block any Telnet access on the WAN interface as any reasonable manufacturer should do - and add a ton of warnings if you even think about disabling the rule that prevents WAN access on port 23), your router would need a security flaw for somebody to change the password.. or somebody from your own LAN did it.

As for your IP, I did a backtrace on all the IPs you've ever used to post on this board and they all belong to the same ISP which is located in good old Europe. IANA is the global IP assigning authority, and if you look up your current IP on RIPE, you do get a match, and it's not from the Netherlands, it's from your home country as are all the other IPs we have on record from you.

[cypher_soundz]

Phew! I found out that my IP was from within my country, was using ARIN the first time (I edited just after posting).
So my router freezing would trigger windows to assign 169.xxx.xxx.xxx to my NIC? :D that’s a relief! I guess my router is to blame! Thanks for the very informative reply!
Is that a standard thing for windows to do? seems a little strange!, I would of thought a 192.168.xxx.xxx would have been better?

I sometimes think I am a little paranoid lol, but I don't know :o.
Thanks again for the reply I can put down the Valium bottle now...oh its empty

:p lol
Regards
Cyph

[Doom9]

Is that a standard thing for windows to do? Yes, this is standard. That is unless you have XP and a secondary network configuration defined that doesn't use DHCP.. in that case you'd get the IP from the secondary network configuration (and of course yet another "new network detected" message). And sometimes, even though DHCP is working, I'm having problems taking my notebook from home (192.168 private addys) to work (10.x private addys) and I have to reboot to get a working IP again.

[cypher_soundz]

Good to know, I will remember that, might stop allot of confusion in the future!
Regards
Cyph

[BoNz1]

Doom9, you don't have to reboot do you to get another IP do you? I sometimes have this problem when I take my laptop to friends houses and to school and then bring it home. What I do is use the ipconfig utility. Launch command prompt, type ipconfig /release then ipconfig /renew I think this is all that gets done when you reboot anyway. Maybe this is nonsense but it seems to work for me :).

[Doom9]

@BoNz1: I know about that, I use ipconfig /release and /renew when I can. However, if Windows switches you to the secondary configuration which is static, I have yet to find a way to switch back to the primary (which is dynamic and thus allows you to demand an IP).

[bit-wise]

If you use SpeedStream's routers, there is a firmware bug that will cause Windows to report a public IP address on a DHCP resolution *inside* the firewall for no apparent reason. Ipconfig /release, /flushdns, reboot will not fix the problem - the only way I can get a legit NATed private IP address again is to hard reset the router. (That is, shut it off for 10+ seconds, turn it back on, then bring up all the machines after the router comes back on-line).