Netbios nbdgram issues in firewall log

[zbrownmd]

Has anyone ever seem this

Just about every server/workstation in the domain...including remote offices is trying to make port 138 connections to these 4 ip addresses:
10.24.1.230
10.22.1.225
10.20.1.221
10.21.1.221

anyone have any idea where to look for what ever is casusing the machines to try this.

I looked at dhcp and don't see these addresses in there.

we are using 10.x.x.x but do not have a lan 10.24, 10.22,...

I've looked everywhere and can find nothing

 

[dmandell]

NetBIOS over TCP/IP uses b-node broadcasts for name resolution and registration on your local LAN segment on UDP ports 137 and 138.

NetLogon and Browsing use UDP 138

If you are using WINS, have you checked your WINS database for these IP addresses?

Dana

 

[GlenJohnson]

http://www.arin.net

Interesting. Look at what arin says. Type your ip addresses in the box.

Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us
(815)229.0826

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884
"Fortunately, somewhere between chance and mystery lies imagination."
Luis Buñuel (1900-1983); Spanish filmmaker.