strange connections to 172.16.0.11

[wimvanherp]

In my network a number of computers regularly try to make connections with an unknown computer on 172.16.1.11 . This is an adress that does not fit in our ip-schema and I have no idea what service on (NT or Win2000) tries to do this. We have been monitoring and also computers that are silent do this ... The firewall manager complains that his log gets full of rejected packets (because these packets can never get on internet).



Has anybody an idea ? Wim Vanherp
Wim.Vanherp@belgacom.net

 

[MztrNyceGuy]

wimvanherp,

I am unaware of any specific service/program on a windows server that automatically tries to connect to that IP address however I do have a couple of other questions.

Are all your computers doing this?
Have you ever had that IP address Scheme before?
Is your Virus Program dat file up to date?

I would suggest to check the lmhost file of the computers if its only a select few and make sure there isnt something in there. I would also check through your WINS/DNS and ensure that this IP address is not there (initiate scavaging) sometimes if you have used a segment before you set up a static IP (11 is a range where servers could be) for name resolution issues. I would also check for virus problems / trojan problems. As a Last resort I would set up a computer on a segment and make it's IP address the one in question and run monitoring tools to see what is happening on the opposit end.

It could be a trojan that is trying to contact the "initiator" of the effected computer, or it could be a valid program trying to go to a site / computer that is not valid any more.

Regards,