RE: Odd addresses on my wireless network

["Jim Harrison (ISA)" <jmharr () microsoft com>]

To add to the clarification, 169.254/16 addresses are APIPA; used by 
Windows ME and later when DHCP servers aren't available or responsive.
The 169.254.255.255 IP is a broadcast address and as such, won't have 
an associated MAC.

-----Original Message-----
From: Ron [mailto:iago () valhallalegends com] 
Sent: Wednesday, November 24, 2004 11:25 AM
To: Michael Acosta
Cc: incidents () securityfocus com
Subject: Re: Odd addresses on my wireless network

Windows computers, and some routers, have an obsession with sending 
traffic to "239.255.255.253" for something to do with upnp 
connectivity.  I didn't even realize this was happening until I set up 
Snort on my Linux box, and discovered packets destined for that 
(unroutable) address every second or so.  If either of your routers had 
upnp enabled, and you don't know what that is or don't use it, then I 
would recommend disabling it.

As for the rest, I'm unsure. 

Michael Acosta wrote:

> I noticed some odd behavior on my wireless network this afteernoon. I
> didn't think too much of it at the time, but now it really seems odd.
>
> When I tried to access the internet from my laptop, I realized that I
> couldn't, even though I had LAN connectivity. I have two wireless
> points in my house, one is an Apple Airport Extreme (10.0.1.1), and
> the other is an Apple Airport Express (10.0.1.250), set up for WDS.
> Both were on, but I couldn't reach the Extreme station via Airport
> admin. I went in the room it's in to reset it (I've had to do that
> before,) and noticed that the TX/RX lights on the front were really
> moving, as if it were quite busy. My DSL modem was doing the same
> thing. I went back to my laptop, and ran "arp -a", and came up with
> this (even though I still couldn't reach the base station):
>
> $ arp -a
> ? (10.0.1.1) at 0:3:93:e7:36:da on en1 [ethernet]
> ? (10.0.1.250) at 0:11:24:3:77:c4 on en1 [ethernet]
> ? (169.254.61.156) at 0:11:24:3:77:c4 on en1 [ethernet]
> ? (169.254.255.255) at (incomplete) on en1 [ethernet]
> ? (224.0.0.2) at 1:0:5e:0:0:2 on en1 permanent [ethernet]
> ? (224.0.0.251) at 1:0:5e:0:0:fb on en1 permanent [ethernet]
> ? (239.255.255.253) at 1:0:5e:7f:ff:fd on en1 permanent [ethernet]
>
> en1 is my Airport card. 
>
> Like I said, I didn't think it was too odd at first, I simply reset
> the base station. When it came back up, I could reach the internet. I
> ran arp -a again, and it only showed 10.0.1.1, as expected.
>
> How could blackhole traffic, and reserved arp traffic show up? I'm no
> network expert, but I would assume that if I I had it's MAC address,
> it was somehow on my network... right? By the way, I do have some
> amount of security on (128 bit WEP and MAC address whitelisting.)
>
>