Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've found some ip address that's not in my DHCP range.. which is weird because I set my DHCP range 192.168.2.xxx but these ip have 172.xxx.x.xxx or 192.168.1.xxx range I want to block them, how? I'm using D-Link DIR-605L N 300 router.. Thanks.

MY router's settings

share|improve this question
1  
Block them from what? Where did you find them? –  David Schwartz Dec 11 '12 at 13:24
    
I found them in my router's active session. I want to block them from my router. There's someone who's been sucking my internet bandwidth, I've blocked his MAC address, but then these "fake" IP's show up. –  Muhammad Adhisukma Dec 11 '12 at 13:31
    
Assuming your router is also doing NAT, it won't matter, since it won't NAT an address outside its subnet. You need to fix the actual problem. How is someone connecting to your network? Are you using WPA? –  David Schwartz Dec 11 '12 at 13:35
    
Here's a printscreen of my roter's active session list postimage.org/image/g7pd4ir3n –  Muhammad Adhisukma Dec 11 '12 at 13:36
    
Each has exactly one UDP session. It looks like DHCP. Are you sure this isn't just your own machines configuring themselves? –  David Schwartz Dec 11 '12 at 13:39

2 Answers 2

First, note the "Helpful Hints" section of the page (top right). the NAPT page shows WAN->LAN connections, so most of the hosts on the list will be outside your network (and obiviously would not be assigned by your DHCP.). Also note, that each has a UDP Session count of 1. UDP is a connection-less protocol, so usually NAT treats each packet as a session, unless the packets are received in a timely manner on a port a packet was just sent out on.

The 192.168.x.y and 172.16.x.y addresses are likely your ISP network, since those are RFC1918 blocks and are not publicly routable. Many cable modems use the network 192.168.1.x. do a tracert to those hosts and see if they are on your providor network. they may be your ISPs DHCP and DNS servers since they are UDP streams.

since these connections are involving comms partners that are outside your network, you can block them at the firewall, by establishing a kill rule. check your router documentation for instructions as to how to set up the firewall, and kill those connections, even if they are solicited from inside your network. also make sure you don't have any ports forwarded in NAT.

share|improve this answer
    
Not 100% understand the terminology you use here, but I'm gonna follow your instructions, do the router's firewall.. thanks –  Muhammad Adhisukma Dec 11 '12 at 14:30

You are looking at the wrong table, if you are trying to see if some guy is connected to let say the wireless facility of your router the NAPT table is not the one.

The NAPT table shows you the connections that you are establishing to the outside world seen by your router's NAT (Network Address Translation) engine.

If you want to see if you got "company" try to see the DHCP table and see there if there are assignments to unknown users.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.