UNSOLVED

RoHe

updated

7 years ago

R

RoHe

12 Elder

45230 Posts

172625 Points

0

4120

December 26th, 2019 17:00

Suspicious incoming connection requests

McAfee (Win 10 Pro) is reporting numerous "suspicious incoming network connection requests" and blocking them today. They're coming in at least ~7-8 times per hour. OK, good, the firewall is working but here's the strange part...

The IP address requesting all these "suspicious" connections is the same one that's assigned to my PC today.  (I get a new IP every time the PC is rebooted.) 

I use ethernet that's hardwired to my ISP's FiOS service without a router. So why is my PC pinging itself? And what does it mean for functionality if the firewall blocks every incoming attempt to connect to itself?  Not seeing anything wrong with the connection or speed, etc.

What am I missing...?

  • speedstep

    11 Legend

    46969 Posts

    3785

    0

    Posted December 27th, 2019 17:00

    What does it say with admin Command Prompt  NOT POWERSHELL


    C:\WINDOWS\system32>netstat -b -o -a -r -n

    I normally disable IPV6 and ISATAP and Teredo.

    I also TURN OFF update strangers on the internet for windows update.

    I also TURN OFF All live tiles on the start menu.

    netsh int ipv6 isatap set state disabled
    netsh int ipv6 6to4 set state disabled
    netsh interface teredo set state disable

    Microsoft Windows [Version 10.0.18363.535]
    (c) 2019 Microsoft Corporation. All rights reserved.

    C:\WINDOWS\system32>netstat -b -o -a -r -n
    ===========================================================================
    Interface List
    15...d8 00 90 03 9a 9d .....Gigabit Ethernet Controller
    3...98 2c bc xx xx xx x ......Microsoft Wi-Fi Direct Virtual Adapter
    9...9a 2c xxxxxxxxxxxx ......Microsoft Wi-Fi Direct Virtual Adapter #2
    8...98 2xxxxxxxxxxxxxxx ......Intel(R) Wireless-AC 9560 160MHz
    1...........................Software Loopback Interface 1
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 10.148.198.1 10.148.198.137 35
    10.148.198.0 255.255.255.0 On-link 10.148.198.137 291
    10.148.198.137 255.255.255.255 On-link 10.148.198.137 291
    10.148.198.255 255.255.255.255 On-link 10.148.198.137 291
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
    224.0.0.0 240.0.0.0 On-link 10.148.198.137 291
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
    255.255.255.255 255.255.255.255 On-link 10.148.198.137 291
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    1 331 ::1/128 On-link
    1 331 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None

     

  • RoHe

    12 Elder

    45230 Posts

    172625 Points

    3768

    0

    Posted December 29th, 2019 12:00

    Not sure what I should be looking for here:

    Interface List
    25...00 4e 01 b5 ae 64 .....Killer E2400 Gigabit Ethernet Controller
    2...40 23 43 cf 35 a3 ....  ..Qualcomm QCA9377 802.11ac Wireless Adapter
    19...42 23 43 cf 35 a3 ......Microsoft Wi-Fi Direct Virtual Adapter #7
    15...52 23 43 cf 35 a3 ......Microsoft Wi-Fi Direct Virtual Adapter #8
    1...........................             Software Loopback Interface 1
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 173.241.20.1 XXX.XXX.XX.XXX 25
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
    173.241.20.0 255.255.255.0 On-link XXX.XXX.XX.XXX 281
    XXX.XXX.XX.XXX 255.255.255.255 On-link XXX.XXX.XX.XXX 281
    173.241.20.255 255.255.255.255 On-link XXX.XXX.XX.XXX 281
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
    224.0.0.0 240.0.0.0 On-link XXX.XXX.XX.XXX 281
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
    255.255.255.255 255.255.255.255 On-link XXX.XXX.XX.XXX 281
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    1 331 ::1/128 On-link
    1 331 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None

    ------------------------

    IPV6 is disabled
    Update strangers is disabled
    netsh int ipv6 6 to 4 is disabled

    My ethernet adapter is set up as "public" so I should be hidden. Today I'm getting pinged (9 times an hour) by the public IP address automatically assigned to this PC when I booted it today and also by 169.254.13.148 which is a bogus IP address. So I'm clearly being seen, but at least the McAfee firewall is blocking them.

    My ISP shrugs and says I should connect the PC to a WiFi router and not directly using ethernet. So what was the point of them installing a FiOS ethernet port in every room when this house was being built...?

     

  • speedstep

    11 Legend

    46969 Posts

    3762

    0

    Posted December 30th, 2019 08:00

     

    169.254.XXX.XXX  means it cannot find DHCP server.

    This is the fail over position for windows.

    127.0.0.1 is loopback.

    Qualcomm QCA9377 is 802.11 AC and Bluetooth built in.

    So the driver for this device is borked.

    802.11ac combo SoC Bluetooth 5

     

    Key Negotiation of Bluetooth (KNOB) attack, the vulnerability could allow remote attackers in close proximity to targeted devices to intercept, monitor, or manipulate encrypted Bluetooth traffic.

     
     
  • RoHe

    12 Elder

    45230 Posts

    172625 Points

    3749

    0

    Posted December 30th, 2019 11:00

    The Qualcomm WiFi+BT driver works fine. It connects to my WiFi router on either 2.4 or 5 GHz. The problem is the signal is weak because my router is on the second floor. I need it up there to connect to a lappy, cell phone, e-reader, etc - things that don't have an Ethernet port and tend to migrate up to the third floor. So it's easier to connect the desktop PC directly to the Ethernet port next to it on first floor.

    Turns out one of the IPs that's been pinging me, not just my own assigned IP, also belongs to my ISP. They finally looked and found that one of their other customers has been "probing" their network. Guess that's a polite way of saying it's a hacker looking for unsecured devices. They promised to put a stop to it so we shalll see...