I've found some traffic, that I'm told is just a normal Win2K thing,
but noone can tell me what it is for.

I was looking at traffic from a remote location, using a sniffer. I
noticed that one of our servers at a central site was scanning the
subnet. It was sending out a NBTSTAT -A for each IP in the range.

The people who set up the server are gone, and noone seems to know who
is currently responsible for mainaining it, so I can't really ask what
was set up.

What "normal" activity of Win2K would scan all the machines on a
different subnet. It is not a domain controller, and it is not a file
server. It is a standalone server for storing log files.

Any ideas?

just to be safe i would scan that machine for worms and viruses.

"Trent Collicutt" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I've found some traffic, that I'm told is just a normal Win2K thing,
> but noone can tell me what it is for.
>
> I was looking at traffic from a remote location, using a sniffer. I
> noticed that one of our servers at a central site was scanning the
> subnet. It was sending out a NBTSTAT -A for each IP in the range.
>
> The people who set up the server are gone, and noone seems to know who
> is currently responsible for mainaining it, so I can't really ask what
> was set up.
>
> What "normal" activity of Win2K would scan all the machines on a
> different subnet. It is not a domain controller, and it is not a file
> server. It is a standalone server for storing log files.
>
> Any ideas?

Nope. Norton's running and hasn't reported anything. Or so I am
told. it is just being put down as normal Windows behaviour, which
will continue until we hire someone to do some serious OS hardening.

I'm from a Novell background. I don't have enough practical
experience with 2000 server to know why it might "normally" do
something like this.


"Dave" <(E-Mail Removed)> wrote in message news:<uG2UJm8#(E-Mail Removed)>...
> just to be safe i would scan that machine for worms and viruses.
>
> "Trent Collicutt" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > I've found some traffic, that I'm told is just a normal Win2K thing,
> > but noone can tell me what it is for.
> >
> > I was looking at traffic from a remote location, using a sniffer. I
> > noticed that one of our servers at a central site was scanning the
> > subnet. It was sending out a NBTSTAT -A for each IP in the range.
> >
> > The people who set up the server are gone, and noone seems to know who
> > is currently responsible for mainaining it, so I can't really ask what
> > was set up.
> >
> > What "normal" activity of Win2K would scan all the machines on a
> > different subnet. It is not a domain controller, and it is not a file
> > server. It is a standalone server for storing log files.
> >
> > Any ideas?