Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have what may be a simple issue, but it is something I've never noticed before, and I wanted to see if it was cause for concern or action was needed.

When checking something else with netstat.exe on a Windows system, I noticed the System Process listening on various ports - (137, 138, 139) from a local IP that is not my local IP.

Specifically, my local IP is and the address shown is I've never seen any local IP's on my network have an address that didn't have a '1' for the 3rd digit group, but more importantly, the System process is listing from somewhere on my pc but apparently not from my pc.

I'm essentially a novice when it comes to Network Protocols and such, so keep that in mind when answering.

Any ideas?

share|improve this question
Do you have any virtualisation software installed? (e.g. VMware Workstation, VirtualBox) – James O'Gorman Jan 7 '13 at 20:38
Yes: VirtualBox, though the process is not running. – user1167442 Jan 7 '13 at 20:39
up vote 4 down vote accepted

As you've said you have VirtualBox installed, it's likely to be this.

By default, VirtualBox (and VMware Workstation) create a virtual network adapter so that VMs can be NATed from your machine's address. The subnet it uses is based on what it thinks is an unused /24 on your network.

share|improve this answer
Also, the ports you mention (UDP 137, 138 and TCP 139) are used for NetBios so nothing to worry about. – Alex Jan 7 '13 at 20:46
Thanks for that. How long does it continue to exist after the program stops running? I would think it would not be economical to continue listening on that port for as long as it has been since I was last running the program. If you know....This is just out of curiosity. – user1167442 Jan 8 '13 at 3:30
I think you're slightly misunderstanding how it works; a virtual network adapter is created and therefore has an IP address. Windows will automatically listen on all interfaces for NetBIOS traffic (ports 137-139) so there's no process you can stop here (other than disabling NetBIOS). – James O'Gorman Jan 8 '13 at 7:24
Thank you. And just so I'm crystal clear - there is now a new adapter that would show up in device manager, and that is what is being listened to, and will be listened to regardless of whether or not the machine is running? – user1167442 Jan 9 '13 at 18:08
Regardless of whether a virtual machine is running, yes. – James O'Gorman Jan 10 '13 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.