network scanning

[samir]

hello

i have two win2000 server, two win2000 professional and few win98 installed
on network.
using network monitor i discovered that all four win2000 machines are
sending ip packets
to addresses starting from 0.0.0.0 to 255.255.255.255. it has slowed my
network a lot.
can anyone tell me what it could be, or where to start to look for help on
net?
help please

thanks

 

[Steven Umbach]

It is not unusual for computers to send to adresses ending with .255 which are
broadcasts and to known ip addresses on the network. It would help to run Netmon
on the server to get an idea what kind on traffic it is. Anytime you see unusual
activity you should run virus scan with the latest virus definitions on your
computers and make sure they are up to date with critical patches from Windows
Update. --- Steve

https://www.microsoft.com/security/protect/

 

[samir]

Thanks for answering.
I used netmon to check traffic and server is constantly
sending ip packets to all available ip addresses counting from 1.1.1.1 to
255.255.255.255
like
....
....
167.110.11.10
167.110.11.11
....
200.130.22.16
200.130.22.17
....
....

any ideas please

thank you

 

[Steven L Umbach]

What port or ports is it sending on? That is definitely not usual behavior, and were
you able to run virus and trojan scans? Look in Task manager for any unusual
processes and use netstat -an or better yet Fport to see if any unusual ports are
open/connected/listening and mapped to any suspect applications. --- Steve

http://packetstormsecurity.nl/filedesc/fport.zip.html