Atypical IP address assigned

[BizLorax]

I've been using the Netgear Nighthawk C7000 router about a year or so - works great.

We recently got our daughter an iPhone 6S and I notice that the router frequently shows an atypical IP address for her phone.

All other devices are assigned an 192.168.0.xx address.  But my daughter's iPhone shows 67.204.180.0 

Why would the router show 67.204.180.0  as the address for the one iPhone?

---

Details:

The new iPhone often, but not always, shows an 67.204.180.0 address. It some times gets a typical 192.168.0.xx address.

We have a few other iPhone and iPad devices, a few android devices, and a few windows devices, printer, etc.

All of these devices get the typical 192.168.0.xx addresses.

The new iphone is the only one that does this.

I checked and 67.204.180.0 is an IP address in Bend,OR.

We live in North Carolina and get our internet through TimeWarner cable.

My daughter's iPone does not have a data plan.

It is on a T-mobile unlimited talk/text plan -  no data.

--

Queston:  Why would the router show 67.204.180.0  as the address for the one iPhone?

[michaelkenward]

Looks like 67.204.180.0 is a phone operator TDS TELECOM.

Maybe she is conecting to them and not to your wifi.

[BizLorax]

Regarding the atypical address being associated with an IP provider being used on the phone -

I thought of something like that.

But my daughter is 14 and does not pay for any internet service on that phone.

She only has internet service (or so I thought) when connected to a wifi sources (such as our home router or her school's network).

Also, my wife's iPhone (a business phone with unlimited data) connects to our router like any other device and gets a standard IP address assigned by router, it does not get an IP address for her company's IP provider.

We have had many visitors to our house and the router allways assignes a 198.... IP address to their devices when they connect to our router.

I have never seen an apparently 'external' IP address displayed on our home network.

Any other possibilities to explain this?

Biz

[BizLorax]

In looking at the router logs I see many entries like those listed below assoicated with this atypical IP address.

Does anyone know what this means and if I should be concerned?

[DoS attack: Teardrop or derivative] from 67.204.180.0, port 65535

DoS attack: Illegal Fragments] from 67.204.180.0, port 65535

[DoS attack: Ping Of Death] from 67.204.180.0, port 65535

177.128.174.47:65535	67.204.180.0:65535
target	source

[michaelkenward]

Netgear's logs record many of these "false positives". (Search this forum for more examples.) Many people have posted them here and reel back in amazement when someone goes to the trouble to "whois" them an reveal that they often come from their Internet service provider, Google or some similarly harmless source.

Here is the result for the IP address you posted:

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#


#
# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=67.204.180.0?showDetails=true&showARIN=false&showNonArinTopLevelN...
#

NetRange:       67.204.128.0 - 67.204.191.255
CIDR:           67.204.128.0/18
NetName:        NETBLK-TDSNET-BEND
NetHandle:      NET-67-204-128-0-1
Parent:         NET67 (NET-67-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS21864
Organization:   TDS TELECOM (TDST)
RegDate:        2007-10-26
Updated:        2014-12-11
Ref:            https://whois.arin.net/rest/net/NET-67-204-128-0-1


OrgName:        TDS TELECOM
OrgId:          TDST
Address:        525 Junction Rd.
City:           Madison
StateProv:      WI
PostalCode:     53717
Country:        US
RegDate:        1994-12-16
Updated:        2017-01-28
Comment:        http://www.tdstelecom.com
Ref:            https://whois.arin.net/rest/org/TDST


OrgTechHandle: INO44-ARIN
OrgTechName:   IP Network Operations
OrgTechPhone:  +1-800-358-3648
OrgTechEmail:  ispadmin@tdstelecom.com
OrgTechRef:    https://whois.arin.net/rest/poc/INO44-ARIN

OrgTechHandle: SERVI6-ARIN
OrgTechName:   Service Activation
OrgTechPhone:  +1-800-358-3648
OrgTechEmail:  serviceactivation@tdstelecom.com
OrgTechRef:    https://whois.arin.net/rest/poc/SERVI6-ARIN

OrgTechHandle: INE14-ARIN
OrgTechName:   IP Network Engineering
OrgTechPhone:  +1-800-358-3648
OrgTechEmail:  IPRequests@tdstelecom.com
OrgTechRef:    https://whois.arin.net/rest/poc/INE14-ARIN

OrgAbuseHandle: ABUSE163-ARIN
OrgAbuseName:   abuse
OrgAbusePhone:  +1-800-358-3648
OrgAbuseEmail:  abuse@tds.net
OrgAbuseRef:    https://whois.arin.net/rest/poc/ABUSE163-ARIN

RAbuseHandle: NETWO612-ARIN
RAbuseName:   NETWORK OPERATIONS
RAbusePhone:  +1-541-312-6576
RAbuseEmail:  nocsupport@bendbroadband.net
RAbuseRef:    https://whois.arin.net/rest/poc/NETWO612-ARIN


#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

Perhaps this is an ISP that hands them out to customers.

What is your own IP address on the Internet?

[BizLorax]

Thanks.

Yes I saw the numerous posts discussing false-positives.

But I didn't see anything that looked like a definitive response from Netgear acknowledging this.

I also had identified the the identity of the rogue IP address and it has no obvioius connection to my provider (rogue is in Oregon, I am in NC).

It is one thing for a router or any security system to have false positives.

But it is very pecurliar that a router could be displaying an incorrect IP address for an attached device.

I would think that IP assignment would be one of the most basic functions for a router.

Anyway - this issue does not seem to a concern to this forum - so I'll cross it off my worry-list.

Regarding your specific comments/questions:

Perhaps this is an ISP that hands them out to customers.

----We are not customer of that ISP. Don't know why they'd have anything to do with us. 

What is your own IP address on the Internet?

---here is partial of our address: 24.162.***.***