Re: Windows Time Service accessing unknow IP address

Tech-Archive recommends: Speed Up your PC by fixing your registry

Giuseppe Nacci wrote: 
David wrote:

Hi,

We have a windows 2000 Advanced Server with (mostly) windows XP
workstations.
The DC is time synced to an external source, and appears to be the
only time source listed in the w32time settings.
The workstations are setup to sync to the DC and this also appears to
be the only time source listed on the workstations.
The actual time synchronisation works but there is an added side
affect. All PCs including the server are attempting to access an
unknown IP address - 191.168.1.225). I can see this on the firewall
logs and also using a port scanner on the client PCs.
Our internal subnet is configured for the 192.168.x.x range.

This only happens when the Windows time Service is running, and using
the port scanner I have confirmed that it is the svchost process
started by W32time which is attempting the access

Anybody got any ideas, where the rogue IP address could be coming
from?
Thanks,
David



Is 191.168.1.225 your client?
To which server is syncro the DC?
The clients point to DC to syncro or where? Did u set it by GPO?
Remember that Time Syncro require port no.123 opened.


191.168.1.225 is unknown on our network. I guess it may be something that was set historically, but I can't find any reference to it in our setup.
The DC is syncing to an external server - ntp.esat.net.
The client points to the DC and is set using "net time /setsntp:timeserver"

Other info - Rogue IP address is being accessed on port 1230
Also, not sure if this will provide any clues....On one of the clients we have VMware installed and curiously it is actually accessing the correct ip address of the DC on port 123.
.

Relevant Pages

  • Re: SPAMBOT Symptoms?
    ... I'm going to study this and test it on my home server before trying on ... To block port 25 from workstations, ... have the tool for it...the Trend CSM client firewall. ... then delete the exception for the SMTP port. ...
    (microsoft.public.windows.server.sbs)
  • Re: Can connect to some, not to others on the LAN
    ... Exactly how and with which client do you try to connect? ... What happens when you telnet to the server, using the port you ... I've done the same thing on all the workstations and can only ...
    (microsoft.public.windows.terminal_services)
  • Re: thin client com ports
    ... I'm glad that you got at least one more client working! ... MCSE, CCEA, Microsoft MVP - Terminal Server ... the COM port settings? ... I am testing several thin clients. ...
    (microsoft.public.windows.terminal_services)
  • Re: network installation manager
    ... there is a firewall between master and client machines, ... NIM Communication within a Firewall Environment ... master via nimclient calls to the nimesis daemon. ... reserved port range of 1023-513. ...
    (comp.unix.aix)
  • help: using smtp.gmail.com as SMART_HOST
    ... with my Google gmail address. ... is pop.gmail.com, using port 995. ... Retrieving mail is not the problem since my Google searches ... client, I believe the term is) to send my mail to Google's ...
    (comp.mail.sendmail)