Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have what may be a simple issue, but it is something I've never noticed before, and I wanted to see if it was cause for concern or action was needed.

When checking something else with netstat.exe on a Windows system, I noticed the System Process listening on various ports - (137, 138, 139) from a local IP that is not my local IP.

Specifically, my local IP is 192.168.1.67 and the address shown is 192.168.56.1. I've never seen any local IP's on my network have an address that didn't have a '1' for the 3rd digit group, but more importantly, the System process is listing from somewhere on my pc but apparently not from my pc.

I'm essentially a novice when it comes to Network Protocols and such, so keep that in mind when answering.

Any ideas?

share|improve this question
2  
Do you have any virtualisation software installed? (e.g. VMware Workstation, VirtualBox) –  James O'Gorman Jan 7 '13 at 20:38
    
Yes: VirtualBox, though the process is not running. –  user1167442 Jan 7 '13 at 20:39

1 Answer 1

up vote 4 down vote accepted

As you've said you have VirtualBox installed, it's likely to be this.

By default, VirtualBox (and VMware Workstation) create a virtual network adapter so that VMs can be NATed from your machine's address. The subnet it uses is based on what it thinks is an unused /24 on your network.

share|improve this answer
1  
Also, the ports you mention (UDP 137, 138 and TCP 139) are used for NetBios so nothing to worry about. –  Alex Jan 7 '13 at 20:46
    
Thanks for that. How long does it continue to exist after the program stops running? I would think it would not be economical to continue listening on that port for as long as it has been since I was last running the program. If you know....This is just out of curiosity. –  user1167442 Jan 8 '13 at 3:30
    
I think you're slightly misunderstanding how it works; a virtual network adapter is created and therefore has an IP address. Windows will automatically listen on all interfaces for NetBIOS traffic (ports 137-139) so there's no process you can stop here (other than disabling NetBIOS). –  James O'Gorman Jan 8 '13 at 7:24
    
Thank you. And just so I'm crystal clear - there is now a new adapter that would show up in device manager, and that is what is being listened to, and will be listened to regardless of whether or not the machine is running? –  user1167442 Jan 9 '13 at 18:08
    
Regardless of whether a virtual machine is running, yes. –  James O'Gorman Jan 10 '13 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.