Hi there,

I currently administrate a small network, approx 40 users, using NT4 SP6 and all the patches I can find. I have found a local IP address continuing to show up in my PF logs.........no computer appears to be associated with it.
When I try to ping this local address from any computer on the network it comes back unreachable. When I try and ping from the server (2 NICs, IIS 4) I get a response. I also can scan the IP from the server (using LANguard)......but again I cannot get a netbios name.
This is a Local IP address 10.x.x.x.
The thing that irks me is I cant ping it from my WS...just the server which leads me to believe it isnt on my local network at all. Also in my packet filter logs it show it connecting on port 137 UDP.

I am new to this security stuff and have lurked here at AO for a couple of months.
I am hoping someone can help me find this and maybe block it out.

One thing I have looked at is I have a NETBIOS Packet filter setup allowing both directions.
I think I should delete this??

Your thoughts are muchly appreciated.

GG