Comment

Comment on I found a weird IP address on my network that had transmitted an insanely small amount of data. I put the address in my browser and got this. what the heck am I looking at?

r00ty@kbin.life ⁨1⁩ ⁨month⁩ ago

So, as others have saId this is just an unconfigured IIS server, which implies it's either a windows machine, or a windows based VM, well or someone put the default IIS files on another server, but that's unlikely.

When you say "weird" IP I'd wonder what you mean by that.

I think since it's probably a windows machine, from another windows machine typing nbtstat -a <ip> should give you the computer name and workgroup or domain they belong to. See if it matches anything you expect on your network.

If not, maybe it's time to change your WPA wifi key.

source

Sort:hotnew top

Bytemeister@lemmy.world ⁨1⁩ ⁨month⁩ ago
At least get WPA2

source
- r00ty@kbin.life ⁨1⁩ ⁨month⁩ ago
  I don't even think my current wifi kit has WPA (1) as an option. It's WPA2 or 3 only I'm pretty sure.
  
  source
caseyweederman@lemmy.ca ⁨1⁩ ⁨month⁩ ago
It could be a configured one with the default greet page still up.

source
RestrictedAccount@lemmy.world ⁨1⁩ ⁨month⁩ ago
Thanks. I ran nbtstat and it came up empty.

source
- r00ty@kbin.life ⁨1⁩ ⁨month⁩ ago
  Hmm. That would mean it's likely one of the following (well perhaps more options, but these spring to mind)
  
  A windows machine that has the network set as a public network, or netbios specifically blocked on LAN.
  
  A windows machine that has all the netbios services disabled.
  
  Not a windows machine, or a container as others suggested that's running some kind of IIS install
  
  Not a windows machine at all but for some weird reason IIS files and a web server setup.
  
  I think you suggested in another comment, that it's not in your DHCP client list but has an IP in your normal range. Which suggests it is setup with a static IP. That is odd.
  
  Some other people suggested it could be a container that is using a real IP rather than the NAT that docker etc usually use. I do know that you can use real IPs in containers, I've done it on my NAS to get a "proper" linux install on top of the NAS lite linux that is provided. But I would have expected that you'd know about that, since it would require someone to actually choose the IP address to use.
  
  If you have managed switches you could find which port on which switch the MAC address (as found by lookuping up the arp record for the IP using arp -a) is on (provided the switch allows access to the forwarding tables). Of course, if they're on Wi-Fi it's only going to lead to the access point they're connecting to.
  
  source