How release / renew an IP address

Topic

New Reply

What IP address one will get and how often it is changed can, as it seems, differ quite a bit if one has a dynamic IP address as I do.

For 4 months I have had the same address. Recently I have had some slight problems with my ADSL filter and I will get it changed at the shop (and probably the modem as well). During tests etc. the last days I have turned off and on the modem some times (and disabled the NIC). The problem with the filter/modem is that it sometimes, now more often, drops the connection for some time.

Anyhow, during these power cycles of the modem the last days I have every time got a new IP address. It didn’t happen before (or with 4-6 months between change, even if I turned off modem/disabled NIC).

This evening when I turned on the PC and modem (again new IP address) I started with a look at the Firewall log (ZA), and after just some seconds I was amazed by the rate at which the entries came in. There were hits almost every second that were blocked.

Now, I don’t have a hardware firewall, and normally I will find lets say 400-500 entries during 8 hours. Now there are 25-30 blocked every minute! Then I found that more than 99 % of them were targeting the same port (18007). The sources are from all around the world.

So I thought lets try ipconfig /release & ipconfig /renew, well, didn’t work, got the same address again.

At least ipconfig works but no new address, but if click on the connection (in my case in the tray) and try to repair the connection then I can’t get a new address.

Of course with dynamic addresses one can get some address that has been in heavy use by some other person, but does anyone know some command to truly release and get a new address?

Reply | Quote

Replies

The only way to get a different IP address is to power off the modem and shutdown the pc. Let it sit for about 5 mintues. Then start the modem and boot the PC. The IP address your are assigned is determined solely by the DHCP server of your ISP. You have no control over that.

Joe

--Joe

Reply | Quote

Hi Joe,
Thanks for reply. No, I didn’t think that I would have any control over what (address) or when (changed), but maybe at least could get it changed if released. But I have read many times before that it can take some time.

I did try to shutdown the modem and PC for 10 minutes, but on start I got the same address. Sigh, it’s going to fill my log files.

During the last year I did see a shift in port destinations, suddenly 1026 & 1027 were very popular, and they still are as can be seen at SANS.org … but this is ridiculous 30-40 hits on one port per minute. I know it can be really bad, much worse, but I’m not so used to it, since I have a quite good ISP (and I haven’t got myself any malware).

Reply | Quote

I have NOT gotten a new IP address in over a year, even with the 4 day power outage, I got back my same IP address. I am on cable, but I think you will find that your ISP is not going to give you new IP address every time you turn on you modem. The only times that I have gotten a new IP address is when they (The ISP) has made a change, as the IP address to linked to my modem.

Cable and DSL are NOT run like “Dial up” where you get to share a IP address, you get one that is NOT in use. This way you are guaranteed “Always on” by having a IP address assigned to you. Now if you have a “Permanent or Static” IP address it will NOT change unless BOTH you and your ISP agree. With a “Dynamic Address” your ISP can change it with out your knowledge.

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote

Dave,
As I mentioned, I have before this NOT gotten a new IP address during the last 4 months. At that time (3.5-4.5 months ago) I first rebuilt my PC hardware, and later upgraded to 8 Mbit/s. So after a complete reinstall and new HW I wasn’t surprised I got a new address.

During the year before that I also had ADSL, but at a slower speed, and the address maybe changed 2-4 times over a year.

“I am on cable, but I think you will find that your ISP is not going to give you new IP address every time you turn on you modem.”

Exactly, that is why I was wondering what they are up to.

AND I understand that dynamic IP is just that; they don’t guarantee that I will have the same address all the time, it may change (but it’s not going to change all the time).

But you have to understand that I do react, when I during some hours get 14,500 hits on more or less the same port.

Reply | Quote

With all of the search engines out there you are going to get hit, Having a router between you and your modem will block the hits. When a engine finds a IP address that responds it is reused time and again. There is NOTHING you can do to stop the hits, all you can do is block them.

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote

I KNOW that there is NOTHING I can DO, but BLOCKING (when I have a particular ADDRESS).

At least when that particular new ADDRESS has been ASSIGNED to my PC, every unsolicited ATTEMPT to CONNECT has been blocked and NOT responded to. So that so called search engine, can NOT have found any type of response (from my PC).

So there is no “sharing” going on … then my ISP must have an unlimited number of addresses. If someone destroys his/her PC, goes of the NET, cease to exist, is a former member of the Internet community, then that address IS NEVER used AGAIN?

Reply | Quote

I don’t know a lot about this topic, Argus, but just a few thoughts:

1) My cable ISP will issue a new IP address if you’re disconnected for several hours, as was the case with me last night. Don’t know if you want to try that.
2) I think there’s a difference in “responding” and “acknowledging” that a certain IP address exists. Have you been to Gibson Research and tried his Shields Up to check your “stealth” status?
3) The built-in hardware firewall in my router (supposedly) will not respond to unsolicited packets. I think even a ping to my address would fail.

Reply | Quote

Al,
1) My ISP, as it seems, do not follow some easy, understandable rule. Let’s say I got one address in September; I had the same address if I disconnected some hours every day during the autumn, as well when I disconnected for several days during the holidays. So to answer your question: I’m willing to try that, and as a matter of fact I do it every night.

Around the time for your reply (or my last reply) I got a new IP address. This time there certainly is a slower pace in the activity, but still a little more than with the “first” one, and the “interest” seems to be port 54460.

As I mentioned in an earlier post, all autumn (with the first IP address since that install) there were some “hits” at 1026 & 1027 as the trend seems to be. I’m not the least worried, but when the address started to change at almost every boot, then stuck at one that gave me 14,000 to 15,000 “hits” on one port on some hours, then I was a little frustrated.

Normally I don’t give a what ports gets scanned, so please don’t get me wrong for mentioning specific ports here. The problem here isn’t blocking specific ports, but to have an address that at least get normal attention. Which leads me to:

2) Yes, I know about Steve Gibson, and I have tried his Shields Up every now and then with a new build. Did it the other day before my first post; there is stealth mode all the way.

3) I think that even without a hardware firewall, my ZoneAlarm will block ICMP Echo requests (incoming ping), in fact all ICMP traffic at security level High. Then of course, a hardware firewall is a completely different matter, no strain on the PC.

P.S.
I did a quick call to my ISP had some other questions as well. At that time & weekend no technical support, but they said I could come back & give them the address if I liked, and they could take a look at it. Presumably they pull out addresses from their lists that gets used in bad ways. I will come back to them about the address lease time, see post to Stuart.

Reply | Quote

You may be able to get a different IP address by changing your MAC address and then asking to renew your IP address. You could do this either by using a differerent NIC in your PC, or by going to the advanced properties of the NIC and putting in a fake MAC address.

StuartR

* MAC Address = Media Access Control address. Otherwise known as Physical Address. The default value is to use the Hardware Address, which is is a unique identifier for every Ethernet device, hardcoded by the manufacturer
* NIC = Network Interface Card, the Ethernet card in your PC, sometimes this is built into the motherboard.

Edited by StuartR to add
You may want to check the details of the DHCP address you have been given, by looking at the output of IPCONFIG / ALL. One of the pieces of information you will see is the expiry date for the address you have been given. Here is some output from my PC. You will see that the hotel where I am staying this week has given me a lease that is only good for about 5 hours!


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-14-C2-E0-A8-83
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 167.254.254.39
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 167.254.254.1
DHCP Server . . . . . . . . . . . : 167.254.254.1
DNS Servers . . . . . . . . . . . : 202.96.69.38
Lease Obtained. . . . . . . . . . : 04 February 2007 18:25:23
Lease Expires . . . . . . . . . . : 04 February 2007 23:12:03


Reply | Quote

Stuart,
Yes, a new MAC address & renewal would lead to that. I only have one other NIC around from another PC, but I would rather not use it since I had issues with it, shown “in the question with no answers”.

I’m not so much into this fake thing, and even if my new NIC and drivers added some new options on the advanced tab I can’t see any MAC address there. But I know about tools; don’t have it around now, but I think I saw an option in the SIW tool to change the MAC address.

Yep, I know about IPCONFIG and switches, since I tried release & renew. It’s handy and I use it sometimes, more or less the same info. as if I click on the connection icon I put in the tray, and then chose “Information” (don’t know the English wording in UK/US Windows).

So 5 hours, that’s not bad from my point of view. I think I’ve seen Al mention some “lease time” before also. They are both much longer than mine has ever been. 20 minutes is the standard!

The other day when I was experimenting, I was going to do a reboot just some minute before the lease expired; let’s say it started 4:30, and was set to expire 4:50. When I did a quick check at 4:48 I found that it had been leased again at 4:40. So it is behaving somewhat unpredictable, as mentioned in my reply to Al (one address for several months, then one new every second boot time).

Reply | Quote

If you are up to spending the money on a router I think you’d find that your system would be more repsonsive. If you are getting ‘hit’ that often then ZA is spending time analyzing and blocking that traffic. If you let a router do it then that hardware is another layer of protection for you. You’ll find that ZA will be much less active.

Joe

--Joe

Reply | Quote

Yes, I think you are correct. As I mentioned in my reply to Al, I understand that a router would do most of the work, acting as an extra layer of protection as you say.

Now I have a new address as mentioned earlier, so the number of “hits” are at a much lower level. Latest hours around 35/hour, instead of 3600/hour or more. But still a little different pattern than with my “original” address.

I don’t have any problem with system not being as responsive as I would wish, even when the “hits” were many. I do have a another problem, mentioned briefly in first post, with connection that drops. But I will change the filter/modem. Of course the less ZA has to do, the more is left for other things, so in some way it must be more responsive with HW protection.

Around here some routers I have seen goes for around $55-70, but I haven’t looked too close at that segment. Have other projects this spring & summer, but will think about it.

Reply | Quote

Best of luck. Hope you get your connection issues straightened out. FWIW, in the USA you can find a wired router for $35-50 USD almost all the time.

Joe

--Joe

Reply | Quote