New hostile ip -- my router's? build 2539

[Switeck]

I keep getting this in µTorrent's logger window:

[18:03:24] IpFilter blocked peer 172.30.0.x

[18:03:28] IpFilter blocked peer 172.30.0.x

[18:04:11] IpFilter blocked peer 172.30.0.x

[18:04:12] IpFilter blocked peer 172.30.0.x

[18:04:52] IpFilter blocked peer 172.30.0.x

[18:04:55] IpFilter blocked peer 172.30.0.x

[18:04:56] IpFilter blocked peer 172.30.0.x

[18:05:38] IpFilter blocked peer 172.30.0.x

[18:06:28] IpFilter blocked peer 172.30.0.x

[18:06:32] IpFilter blocked peer 172.30.0.x

[18:08:29] IpFilter blocked peer 172.30.0.x

[18:08:30] IpFilter blocked peer 172.30.0.x

[18:08:37] IpFilter blocked peer 172.30.0.x

[18:08:55] IpFilter blocked peer 172.30.0.x

[18:13:53] IpFilter blocked peer 172.30.0.x

[18:13:54] IpFilter blocked peer 172.30.0.x

[18:15:24] IpFilter blocked peer 172.30.0.x

[18:15:30] IpFilter blocked peer 172.30.0.x

[18:16:10] IpFilter blocked peer 172.30.0.x

[18:16:19] IpFilter blocked peer 172.30.0.x

[18:17:26] IpFilter blocked peer 172.30.0.x

[18:17:27] IpFilter blocked peer 172.30.0.x

The last ip value "x" matches my router!

I have Enable Local Peer Discovery UNCHECKED.

...So why is it even trying to connect to local LAN ips?

[DreadWingKnight]

Are you using a converted blocklist for your ipfilter.dat?

[Switeck]

No, that ip is a LAN ip.

[DreadWingKnight]

some blocklists include RFC1918 ranges (mistakenly).

Loopback connection attempts with some routers will generate such messages.

[Switeck]

I purposefully added my LAN ip range to my ipfilter.dat because µTorrent was repeatedly trying to connect to my router's LAN ip as well as my computer's LAN ip.

Why does µTorrent need to do repeated loopback attempts?

...especially every minute!

[DreadWingKnight]

Did you block your router's WAN IP?

That's where things get messy (not all trackers are programmed to not send loopback info)

[Switeck]

It seems to stop doing loopbacks if I also block my WAN (internet) ip, but I do occasionally get inexplicable tracker timeouts.

I actually caught my connection doing a loopback to itself while µTorrent was running using TCP view.

I disabled ipfilter.dat and I see this now too:

[06:00:34] 68.59.x.x : Connecting: port ###### source: TX

[06:00:34] Incoming connection from 172.30.0.x

[06:00:35] 172.30.0.x : Disconnect: Same ID

[06:00:35] 68.59.x.x : Disconnect: Connection closed

[06:00:37] 68.59.x.x : Connecting: port ###### source: TX

[06:00:37] Incoming connection from 172.30.0.x

[06:00:37] 172.30.0.240 : Disconnect: Same ID

[06:00:37] 68.59.x.x : Disconnect: Connection closed

68.59.x.x is *DEFINITELY* my internet ip.

172.30.0.x is once again my router's LAN ip!

Port ##### is whatever I'm using, I know it is correct.

I even bound µTorrent to an outgoing port so I could spot it outside my web surfing outside the ephemeral port range (about 1000-5000).