Norton Internet Security / Norton AntiVirus

[Calls]

NIS2011 v 18.6.0.29

Vista Home Premium 32 bit

IE8

Ok just installed NIS 2011 last night.  Since then I have rebooted my PC several times. Since the NIS 2011 has just been installed, I've taken to checking the logs to make sure everything is going well.

So when I look at

Firewall-Network and Connections

I see this entry:

Protecting your connection to a newly detected netwrok on adapter "NVIDIA nForce Networking Controller"

IP address  169. 254. 152. xxx (I x'd out these last set of numbers)

When I look up this IP address I cannot find anything about it, where it is from, who it belongs to, if its part of my ISP.

I find nothing at all about it

Now within a minte or less I will then get another reading

Protecting your connection to  a newly detected network on adapter "NVIDA nForce Networking controller"

IP address:  and then the IP addressed assigned to me by my ISP

Then also that the IP address 169. 254.152 .xxx  has disappeared and is no longer being protected

So not sure if this means I'm being "hijacked" to some malicious IP address or what.

Might anyone help me understand this, and if it is malicious/security concern?

[Bombastus]

Hello,

This is perfectly normal. The 169... IP is the one you always get when there is no Internet connection. Once you get a real IP, the 169... IP disappears and is replaced with your real IP.

When you have a 169... IP, it means you have not yet received your real IP from your router/modem/network. NIS 2011 just has better logging than NIS 2010 and starts logging earlier. You always get this 169... for a few milliseconds when you boot the computer, before the real Internet connection has been established.

So - nothing to worry about, everything is as it should be.

[delphinium Norton Fighter]

It means that you either no longer have that connection, or it is temporarily disabled.  The 169 means that it is not working.  It is dropped, or "no longer protected" when it does not require the service.  Did you have an Xbox or some other game device previously.

[Calls]

Del-
No Never had any game system or other device. I have only seen this starting after I installed 2011.
It could be maybe something with my ISP? Maybe their connections are having trouble?

[Calls]

Bombastus/others

1. do others see this entry too?

2. so the 169 IP address is not an outside ) address, its just like a default IP address/ID?

[SendOfJive Norton Fighter]

Hi Calls,

It is nothing to worry about.  When Windows starts up, it looks for a DHCP server in order to be assigned an IP address.  If Windows cannot immediately get an IP address it will assign itself something in the 169.X.X.X range.  Once all your networking components are up and running, WIndows will be able to get a "real" IP address that will connect it to the network or the internet.  Norton is just logging what Windows does automatically before your computer is able to get an IP address to use.

[AllenM Norton Fighter]

Hi Calls,

Try not to check the logs so much, enjoy your computer. NIS will let you know if you have something to worry about.

Please see the follwing MS article and do a page search for "Check whether Windows assigned you an automatic IP address", then expand that section. This will tell you exactly what others have been saying, this IP address is nothing to worry about.

http://support.microsoft.com/kb/956196#am2

Best wishes.

Allen

[Bombastus · Accepted solution]

---

Calls wrote:
Bombastus/others

1. do others see this entry too?

2. so the 169 IP address is not an outside ) address, its just like a default IP address/ID?

---

1. Yes. I booted 15 minutes ago, and look what was in my log: "Protecting your connection to a newly detected network on adapter "Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller" (IP address: 169.254.33.122)". Yay! Followed right after by a "has disappered" message.

2. Yep. If you want to do a little experiment, pull the network cable from your computer and wait until you get a new IP. Guess what it will be? You're right - the 169.xxx IP, because you can't get a real IP with the network cable unplugged.

When you boot your computer, there is a short period of time where you don't have any Internet connection, and that is when you get the 169.xxx IP. As soon as you do get your Internet connection, the 169.xxx IP is no longer needed and disappears.

Your network card can't have no IP address, and when it can't get a real one for some reason, this is the one it creates for itself.

This happened when you were using NIS 2010 as well - it is just that NIS 2010 didn't have as thorough logging capabilites, so you never saw it logged.

[DKN]

Calls,

Thank you for asking this.

I have often worried over this myself.

With the explanations given from the others here, I shall worry no more.

DKN.

[Calls]

thank you everyone!!!

Only checking logs and such because I just had NIS 2011 installed less than 2 weeks ago. Want to make sure all is well.

Also glad my paranoia has helped someone else resolve a curiosity.

LOL