PDA

View Full Version : 192.168.51.x - what is it?



Dummo
29-05-2003, 05:28 PM
Hi,

I'm getting the following message on ZoneAlarm, it's blocking routed packets, then my browser and POP3 both cease to function until I reboot! (OE6, Win XP)

FWROUTE, ... ,192.168.51.2:67,203.97.107.80:68,UDP

It says:

"User: SYSTEM
Program: Generic Host Process for Win32 Services"

I know the 203 number, it's my ISP, Clear.net.

I lookedup the 192 number, and got this WEIRD info! What is this sending routed traffic through my computer? How is it shutting my internet access down? Can anyone help?:O

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 192.168.0.0 - 192.168.255.255
CIDR: 192.168.0.0/16
NetName: IANA-CBLK1
NetHandle: NET-192-168-0-0-1
Parent: NET-192-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment:
RegDate: 1994-03-15
Updated: 2002-09-16

OrgTechHandle: IANA-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-823-9358
OrgTechEmail: res-ip@iana.org

Jen C
29-05-2003, 06:11 PM
I found this information in a ZoneAlarm Forum post:

Alert on Generic Host Process for Win32 Services
This is often due to DNS. Windows can send DNS requests to multiple servers. When the information comes back, it may not be considered the same "state" (meaning ZA might only consider the last outbound request to be the current one, so it treats this as a non-requested packet). If you add the DNS servers to your Trusted Zone, then you should be able to give GH Server rights to Trusted Zone only. I would NOT let it accept incoming from Internet Zone.

By ZoneAlarm blocking these packets, it also blocks your internet access.

They then went on to provided instructions on how to add the DNS to your Trusted Zone:
To add them, start up ZA click the firewall page, click the zones tab and click add IP address. Fill out the form and select trusted from the dropdown list.

As you are with Clear.net, the DNS names are:
Primary DNS 203.97.33.14
Secondary DNS 203.97.37.14

I don't use ZA, so I hope this makes sense to you :)

Let us know it this works.

Jen

Muzzer
29-05-2003, 06:49 PM
Its an IP Address for a lan which use the range 192.168.0.0. to 192.168.255.255 although the first and last numbers are reserved.

Check your network settings in My Network Places. Are you on adsl or are you networked? This type of IP addy is only used on local area networks or intranets not on the internet so ZA is blocking something your comp or you want to comunicate with. Do you have remote access enabled or has somebody tried to enable it for you. If do don't be carefull.

Cheers Murray P

Muzzer
29-05-2003, 06:54 PM
:8} well that last bit makes perfect sense in the context doesn't it, NOT!

> If do don't be carefull. Read as: If you don't be carefull. oh boy must be time for food.

Cheers Murray P

bmason
29-05-2003, 07:43 PM
In addition to the above, its connecting on port 67 & 68 which are BOOTP ports. Which is similar to DHCP if its of any help.

Dummo
30-05-2003, 01:52 AM
Thanks for your message Murray, duh...
I am on a stand alone laptop. I did have "local area connection" enabled but have now disabled it [my computer|right click|local network|disable]. File sharing etc are all disabled as far as I can see. I don't know what asdl is.

My own ISP's address has always been listed as trusted. I have authorised Generic Host as a server and don't get alerts about servers.

But I finally found ONE of the IP addresses, under start|settings|network connections|[connected ISP]

- and I found under networking|TCP/IP|properties for the other one "obtain an IP address automatically"...

I'm now more confused.
Is this my computer sending itself packets??? Why?
Can I insist on a particular IP address so I know what to set my firewall for?
Surely there is some standard procedure if this is such a basic situation??
(I have emailed my ISP with the same question, will advise if they're kind enough to reply).

Sorry can someone explain what BOOTP ports and DHCP are? Sounds worrying...

cyberchuck
30-05-2003, 07:57 AM
Hey

Your computer could be assigning itself an IP Address for itself seeing as it does not have one, and therefore as there is no DHCP server available to give it an IP Address, its decided not to complain, but to assign itself an IP address? (confused :p) - if this is the case, then it will explain why your computer may be sending itself packets.
Click Start > Run and type "CMD" (without the quote marks)
Type "IPCONFIG" (without the quote marks) and this will show you an IP Address or 2. If one of these is 192.168.51.2 then your computer is assigning itself an IP Address most likely, and that is the IP Address it is assigning.

The easiest way around this would be to set yourself your own IP Address then get ZoneAlarm to ignore requests from this.
Click Start > Network > Show all Network Connections
Then double-click the network that is not your account to Clear - should be the LAN connection
Click on TCP/IP and then click properties
Select Use the following IP Address and then where it says IP address type in "192.168.1.1" without the quote marks and in the appropriate places (eg the . will already be there, so just enter 192 then 168)
Set your subnet mask to "255.255.255.0" (same conditions apply)
Click Ok and close the Network Settings
You have just set yourself an IP Address!

Now open up ZoneAlarm and go into your list of internet programs which shows all the applications able to access/not access the internet. Choose the programs allowed internet access, then right click, select Local Zone and then click Allow All. Repeat for each internet program, and this should hopefully fix your problem.

BootP and DHCP are protocols which assign clients an IP Address. For example, when you connect to your ISP they will assign you an IP Address through a DHCP server. Don't worry about it.


CyberChuck

Muzzer
30-05-2003, 11:13 AM
The only thing I might do diff to Cyberchuck would be to set the ip to say: 192.168.1.2 to avoid the default gateway IP most ADSL modems are factory set to.

ADSL = Asychronise Digtal Subsciber Line eg. Jetstream, Jetstart.

HTH Murray P

Dummo
30-05-2003, 02:13 PM
Thanks very much! I looked up ipconfig and it is as you said - and you've told me how to stop it allocating random different numbers so now I can set my firewall!

Cheers, V