2

I have what may be a simple issue, but it is something I've never noticed before, and I wanted to see if it was cause for concern or action was needed.

When checking something else with netstat.exe on a Windows system, I noticed the System Process listening on various ports - (137, 138, 139) from a local IP that is not my local IP.

Specifically, my local IP is 192.168.1.67 and the address shown is 192.168.56.1. I've never seen any local IP's on my network have an address that didn't have a '1' for the 3rd digit group, but more importantly, the System process is listing from somewhere on my pc but apparently not from my pc.

I'm essentially a novice when it comes to Network Protocols and such, so keep that in mind when answering.

Any ideas?

BatchyX
  • 902
  • 4
  • 7
dgo
  • 129
  • 10

1 Answers1

5

As you've said you have VirtualBox installed, it's likely to be this.

By default, VirtualBox (and VMware Workstation) create a virtual network adapter so that VMs can be NATed from your machine's address. The subnet it uses is based on what it thinks is an unused /24 on your network.

James O'Gorman
  • 5,249
  • 2
  • 23
  • 28
  • 1
    Also, the ports you mention (UDP 137, 138 and TCP 139) are used for NetBios so nothing to worry about. – Alex Jan 07 '13 at 20:46
  • Thanks for that. How long does it continue to exist after the program stops running? I would think it would not be economical to continue listening on that port for as long as it has been since I was last running the program. If you know....This is just out of curiosity. – dgo Jan 08 '13 at 03:30
  • 1
    I think you're slightly misunderstanding how it works; a virtual network adapter is created and therefore has an IP address. Windows will automatically listen on all interfaces for NetBIOS traffic (ports 137-139) so there's no process you can stop here (other than disabling NetBIOS). – James O'Gorman Jan 08 '13 at 07:24
  • Thank you. And just so I'm crystal clear - there is now a new adapter that would show up in device manager, and that is what is being listened to, and will be listened to regardless of whether or not the machine is running? – dgo Jan 09 '13 at 18:08
  • 1
    Regardless of whether a _virtual_ machine is running, yes. – James O'Gorman Jan 10 '13 at 19:51