By itself, Greenfoot makes two connections on startup. One is to greenfoot.org, as a quick version check (but that IP is not the IP of greenfoot.org). The other is to your local machine, as Greenfoot actually function as two processes connected by a socket. I suspect this connection is related to the latter connection. Is Greenfoot actually functioning correctly? Are you just mentioning this because your firewall asks you each time?

well, I was looking at my netlimiter client because of something different and saw that greenfoot sometimes connects to 239.255.255.255 on Port 1900. I searched after this and the result was that my hostprocess of the os needs to connect to this ip and port. I just don't understand why it connects, cause I saw no reason. The two processes are greenfoot.exe and java.exe right?

That is an UPNP SSDP message. It's a LAN-only multicast made when a UPNP control point wakes up and attempts to find UPNP devices (printers, etc.) on the LAN. It's not something that Greenfoot is doing deliberately, but it might be something that Java is doing, like contacting your default printer? Not something to worry about anyway, as it's not a globally-valid IP address. See RFC 2365 for all the gory details.