Here is the problem i have been running wireshark on my network to check the network for differnt events happening. Such as Print server still querying dead printer ip address. however i have just came accross one of the pc's on the domain asking the Entire IP scope it belongs to who everyone is PC1 has an ip address of 192.168.10.171 Who has 192.168.10.1 - 192.168.10.255, Tell 192.168.10.171 They all happen in the same time frames. Any suggestions?
Generally you will see this if a machine is trying to send packets to another machine. All I can guess is that the arp who from 192.168.10.171 is due to 192.168.10.171 needing to send packets to the range of IP's listed. Otherwise is 192.168.10.171 running DHCP? if so it maybe checking to see if any of the IP's in that range are in use, simply by asking.
The only reason I could ever think of it wanting to check the entire scope is what Andy said, if it were running DHCP software. Have you tried disabling programs on 192.168.10.171 one by one to figure out which program is asking?
I have started to uninstall software that does not need to be there such as: Google updater - thought it could of been looking for proxy and theses two that i just hate there names HP Participation Program MarketResearch - Both of which had the exact same build number as the hp scanning utilities. This has made no difference. Also the Only DHCP service on the PC is Client.
Dude, the PC is acting as master browser. Completely expected and normal, for Windows Don't worry about it. There's plenty of info on Google if you want to know more, but its related to Windows file&print sharing basically.
Zoon This pc aint sharing any dir or printers and Also it is asking every pc on the same scope 192.168.10.1 - 255 and not the entire network 192.168.1.1 - 192.168.254.255. This pc is not a Domain Master Browser as it is not the Primary Domain Controller or even a secondary. However i ran a wireshark scan for longer and noticed a few more strange packets. i have not revealed the true address as stated why further down NB Namequery adddress.vn.ua (.vn.ua is Ukraine) after searching more info using whois the address has no website and is on several Firewall sites blocklist. at which stage i ripped the pc from the network and done some AV and Antimalware scans. Showing up over 30items not very nice Items Thanks for everyones help. I can hopefuly say one of these items will be the root cause of Interrogating the network range. Also after pulling this pc from the network, we have noticed Network performance and speed increase. Yet again Thank you all.
Every Windows network has a master browser, regardless of whether there's a domain controller or not. Its a throw back to WINS in NT4. IIRC its the device with the lowest MAC address which wins the election to master browser, when there's no PDC to pre-empt the election, and it maintains a list of MAC to IP address. I'm not saying there wasn't something else wrong with the PC - there clearly was!! - but if you do another wireshark a different PC *should* be doing that job. This is true for Windows XP and below, in my experience. As I don't really use Vista I can't be sure it is true for that also.
I have both a Primary domain controller and also a DHCP server's as to why a PC has been elected as a Master browser is strange as it is only doing one of the DHCP's Scopes. Also on my wireshark scan this PC was the only PC asking the range who they where. No other pc was asking other ip range's what they where. however on wireshark both DHCP server's was asking every pc who they where from the scopes that they had set. which i would understand as its giving them IP's. Thanks As suspected after files found under scans after attaching back to the network there has been no more chatter from this pc in the shap of who has 172.17.10.1-255 Thank you all again
