McAfee (Win 10 Pro) is reporting numerous "suspicious incoming network connection requests" and blocking them today. They're coming in at least ~7-8 times per hour. OK, good, the firewall is working but here's the strange part...
The IP address requesting all these "suspicious" connections is the same one that's assigned to my PC today. (I get a new IP every time the PC is rebooted.)
I use ethernet that's hardwired to my ISP's FiOS service without a router. So why is my PC pinging itself? And what does it mean for functionality if the firewall blocks every incoming attempt to connect to itself? Not seeing anything wrong with the connection or speed, etc.
IPV6 is disabled Update strangers is disabled netsh int ipv6 6 to 4 is disabled
My ethernet adapter is set up as "public" so I should be hidden. Today I'm getting pinged (9 times an hour) by the public IP address automatically assigned to this PC when I booted it today and also by 169.254.13.148 which is a bogus IP address. So I'm clearly being seen, but at least the McAfee firewall is blocking them.
My ISP shrugs and says I should connect the PC to a WiFi router and not directly using ethernet. So what was the point of them installing a FiOS ethernet port in every room when this house was being built...?
Qualcomm QCA9377 is 802.11 AC and Bluetooth built in.
So the driver for this device is borked.
802.11ac combo SoC Bluetooth 5
Key Negotiation of Bluetooth (KNOB) attack, the vulnerability could allow remote attackers in close proximity to targeted devices to intercept, monitor, or manipulate encrypted Bluetooth traffic.
The Qualcomm WiFi+BT driver works fine. It connects to my WiFi router on either 2.4 or 5 GHz. The problem is the signal is weak because my router is on the second floor. I need it up there to connect to a lappy, cell phone, e-reader, etc - things that don't have an Ethernet port and tend to migrate up to the third floor. So it's easier to connect the desktop PC directly to the Ethernet port next to it on first floor.
Turns out one of the IPs that's been pinging me, not just my own assigned IP, also belongs to my ISP. They finally looked and found that one of their other customers has been "probing" their network. Guess that's a polite way of saying it's a hacker looking for unsecured devices. They promised to put a stop to it so we shalll see...
speedstep
11 Legend
•
46969 Posts
3785
0
Posted December 27th, 2019 17:00
What does it say with admin Command Prompt NOT POWERSHELL
C:\WINDOWS\system32>netstat -b -o -a -r -n
I normally disable IPV6 and ISATAP and Teredo.
I also TURN OFF update strangers on the internet for windows update.
I also TURN OFF All live tiles on the start menu.
netsh int ipv6 isatap set state disabled
netsh int ipv6 6to4 set state disabled
netsh interface teredo set state disable
Microsoft Windows [Version 10.0.18363.535]
(c) 2019 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>netstat -b -o -a -r -n
===========================================================================
Interface List
15...d8 00 90 03 9a 9d .....Gigabit Ethernet Controller
3...98 2c bc xx xx xx x ......Microsoft Wi-Fi Direct Virtual Adapter
9...9a 2c xxxxxxxxxxxx ......Microsoft Wi-Fi Direct Virtual Adapter #2
8...98 2xxxxxxxxxxxxxxx ......Intel(R) Wireless-AC 9560 160MHz
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.148.198.1 10.148.198.137 35
10.148.198.0 255.255.255.0 On-link 10.148.198.137 291
10.148.198.137 255.255.255.255 On-link 10.148.198.137 291
10.148.198.255 255.255.255.255 On-link 10.148.198.137 291
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 10.148.198.137 291
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 10.148.198.137 291
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
1 331 ff00::/8 On-link
===========================================================================
Persistent Routes:
None