[gallicbear]

Hi there,
I recently downloaded a program called Active Wall. It tracks activity on my home network by IP address. This morning I noticed that two strange IP addresses had been accessed. One of them is nowhere to be traced by IP lookup. Both of them begin with '172'. I had not intentionally accessed any websites. Yet it shows that, respectively, 5 and 7 packets of info were exchanged. I have XP SP3, with firewall on. My router is secure. How does that happen? I blocked these IP addresses in the host file. Does any one have an idea concerning this and what to do? Thanks in advance.

 

[lorjack]

What were the full IP addresses?

Open up a command prompt (Start > run > cmd)
Type the following bolded commands and post the results for each affected machine.

ipconfig /all
ping -a 172.x.x.x (replace with the ip addresses)

 

[gallicbear]

Thanks for the reply.
The full addresses were 172.20.9.62 and 172.24.14.231
When I pinged them, the request timed out.
The first one, according to some search I did earlier, seems to be connected with the University of Singapore. Weird. And my Virus program is up and running, too.

 

[lorjack]

Mmm... i don't know what they are. A whois search show them to be belonging to IANA for "special purposes".

 

[gallicbear]

Thanks for your input, Lorjack.

 

[gallicbear]

For what it's worth, Lorjack, I thank you for telling me about IANA. That put me on some reassuring track by researching this topic. The system does use a bunch of 'private' IP addresses for some reason, with IPs like 172.x.x.x, or 10.x.x.x. I even noticed 192.168.200.x, even though my router has internal IPs of 192.168.2.x
So the subject can become quite interesting... So thanks again for your input.