Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

after "ipconfig /release" I myself am unable to initiate connection to a remote ip, such as using the browser. But can an attacker across the network initiate connection to my ip?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

If you do an ipconfig /release and your IP is removed, then your system's TCP/IP stack is not going to pass through any traffic to applications using TCP/IP from any interfaces without IP addresses. Note that ipconfig /release doesn't affect interfaces that have a static IP set, so those interfaces would still have a manually set IP./

If an attacker continues to send traffic to that IP, your network card does receive it, but your system's TCP/IP stack (and your network card) won't consider it as destined for that system, and therefore won't grab it - the traffic will never make its way up to the application listening on specific TCP or UDP ports.

But, if the NIC is put into promiscuous mode I believe it is possible to continue to pull raw Ethernet frames or IP packets off the card - WinPCap does something like this - but this is really in a sense bypassing the TCP/IP stack. But you need very specific software doing this type of thing. Standard network applications that just listen on specific TCP or UDP ports can't receive any traffic in this situation.

share|improve this answer
    
this makes good sense, thanks –  EndangeringSpecies Mar 6 '12 at 6:26

If your computer does not have an IP address it cannot be reached using TCP/IP. However, you may have other protocols running. IPX perhaps? A reboot would likley allow the system to obtain an IP again.

Then the network srup will also have an impact. If you are behind a firewall, that has an impact.

More info on your concern would assist.

share|improve this answer
    
does my computer really have no ip address after this, as seen from outside? FWIW I am located behind my own wifi router, and I notice that /release executes very fast (/renew takes longer). What would happen if attacker sends me a message to ip address observed from before /release? –  EndangeringSpecies Mar 5 '12 at 16:10
    
If you release all of your adapter then you won't have an ip address. –  Ramhound Mar 5 '12 at 17:42

When you run ipconfig /release your local address (assuming that you are connecting over a router) will be released. It means your computer will not have a valid IP address to send or receive packets from/to your router. It would "isolate" you against an attack, however you must know that IP address belongs to the 3th layer of the OSI model, and you still have a valid MAC adress available on your interface and you computer will keep receiving ethernet frames from your local network(assuming that you have a switch) and another computer from your local network can be a "gateway" to an attacker.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.