2 IP addresses coming from Samsung Galaxy S2

[Dick Goesinya]

Hello all,
I found something very odd today. I doubt it is related to my router and figured I would post here.

I noticed that my girlfriend's Samsung Galaxy S2 is connecting with 2 IP addresses, and one is not within my IP range.

My router's IP address range is set only for 192.168.79.100-200. No VPN's, VLANs or anything else. I have her phone set as a static IP address of 192.168.79.131 but also her phone has a secondary IP address (currently 72.59.92.19)that changes if I reboot the router. Both of these IP addresses share the same MAC address of her cellphone.
Image attached as proof -

We also have another Samsung Galaxy S2 and an S3 and neither do this and I have never seen this behavior before until today.

Possibly malware on her phone or an app with an advert engine in it? She constantly downloads and tries apps but only from Google Play.

 

[Adamsberg]

The 192.168.... is the phone's internal IP on the home network via WiFi. The 72.... is the phone's external IP on the mobile network. The external IP isn't shown when mobile data is switched off and the IP will change every time when you switch on mobile data.
Every smartphone has these two IP's, no reason to worry

Use an app like Network Signal Info on you other phones, it'll show you both IP's.

 

[Dick Goesinya]

OK. It was just odd because it never ever showed up on the router's status page before. I use DD-WRT. Not on any of the phones did this. Now, suddenly, her other IP has been displayed for 2 days straight. I thought it was maybe some new app, etc.

Will check out the program you suggested and explore this further.

Thanks. I appreciate the guidance.

 

[Rukbat]

BTW, for a couple of reasons, assigning a static IP that's within the DHCP range of the router is one of the BAD IDEAS. Your DHCP server is leasing 192.168.79.100 to 192.168.79.200. (I assume the router itself is 192.168.79.1.) Assign static IPs in the ranges of 192.168.79.2-99 and 192.168.79.201-254. You're not getting any problem at this time, but you might - and if you do, I hope your girlfriend likes bald guys.

 

[Adamsberg]

OK. It was just odd because it never ever showed up on the router's status page before. I use DD-WRT. Not on any of the phones did this. Now, suddenly, her other IP has been displayed for 2 days straight. I thought it was maybe some new app, etc.

Will check out the program you suggested and explore this further.

Thanks. I appreciate the guidance.

An afterthought, because it's shown the router's status page and the device name is only an *. The phone might have gived its external ID while it is on mobile data (while the router's reset time) and the ID would be stored but not actual ... but more plausible would be that 72.... is the router's own external ID for the web or its used DNS address. And when the phone is on WiFi again its external ID would be the same as the router's.

 

[Dick Goesinya]

@Adamsberg -

I had originally thought it might be the external address of the router or cable modem but I checked those. My external address starts with 68. I checked with the software you mentioned and it does seem to be the mobile data IP address. Just weird that is shows up on my router and not even sure how that is possible considering that I have the IP range set to 192.168.79. So, how in the heck does a 72.XXX address appear on my LAN status page? lol

PS - It is not there today. Seems to have disappeared. Instead of two IP's she only has the one. Now all the addresses are accurate and within the 192.168.79 range.

 

[Adamsberg]

Yes, with the same MAC the 72... IP has to belong to the phone, sorry, didn't noticed that in your first post.

So the phone use this ID while it's on mobile data, when WiFi isn't available.
Rebooting the router would promt the phone to switch to mobile data while the router's boot time.
But how could the router read out the phone's external ID? May just happen at the moment when the phone switched back to WiFi ... maybe a bug?

 

[Dick Goesinya]

Yes, bug, glitch or odd luck is what I figure. But that was creepy to see a strange address! Immediately makes you think of malware, etc. monitoring packet traffic!

 

[anon(9211328)]

I just found this old thread researching a similar issue. Two Verizon Moto Droid phones showing several out of range strange addresses in addition to the ones I have reserved within my range. I've never seen this before in the usage on the router. I'm on metered sat internet so I check the router's usage statistic often.

 

[Judo2]

BTW, for a couple of reasons, assigning a static IP that's within the DHCP range of the router is one of the BAD IDEAS. Your DHCP server is leasing 192.168.79.100 to 192.168.79.200. (I assume the router itself is 192.168.79.1.) Assign static IPs in the ranges of 192.168.79.2-99 and 192.168.79.201-254. You're not getting any problem at this time, but you might - and if you do, I hope your girlfriend likes bald guys.

 

[Judo2]

They are wrong it's more likely that you have been hacked...there is someone else in control of your device...especially if you find that your apps have been duplicated