Weird IP found on the network, am I being hacked? 1

[confusedtekguy]

I downloaded a network monitor from

http://www.objectplanet.com

(7 day trial version) I've been monitoring our 25 computer network for a week, found a weird IP that every computer, inculding server, communicates with:

IP is 10.0.0.255

protocol: ether.IP.UDP.netbios-ns
port: 137

or
protocol: ether.IP.UDP.netbios-dgm
port: 138

I'm not quite sure what it is... Our domain is in the 10.0.0.xxx range. I can ping it, but not resolve to hostname. Used an IP scan, but it tells me it's not a live host. Looked in the DHCP server address leases, it's not there. Any suggestions about what it is?

 

[lullysing]

If you network is 10.0.0.* .... then 10.0.0.255 is your BROADCAST adress if your netmask is something like 255.255.255.0

Am i right ?

_____________________________
Don't forget folks,
...unless you want the coco-macaques to be send for you,
... vote people with tipmaster awards if they helped you.

 

[confusedtekguy]

Yep, that's what I thought it would be... but for some reason I've always assumed the broadcast would be 255.255.255.255. Incoming silly question - what exactly is broadcast used for? And why do I sometimes see 10.0.0.255 sending packets to itself? Thanks alot for the info

 

[lullysing]

One check in /etc/services later...
________________
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
________________

255.255.255.255 is broadcasting the whole world. All i know about the packets it that thery have something to do with NETBIOS, which is generally a windows thing.

Broadcast can be useful for diagnostics, and are used for scanning, , certain applications, etc. The Ip is normal.

--Dave.


_____________________________
Don't forget folks,
...unless you want the coco-macaques to be send for you,
... vote people with tipmaster awards if they helped you.

 

[John Lewis]

The broadcasts in question are used to update the names of the computers that are active on the network. You see the results when you browse your local network. Each of the computers that shows up has broadcast an annoncement that it is connected and available.

 

[lullysing]

There you go, now here's a fella that knows netbios ( I admit to total failure on windows netowkring... i'm a linux/unix guy myself)

_____________________________
Don't forget folks,
...unless you want the coco-macaques to be sent for you,
... vote people with tipmaster awards if they helped you.