No announcement yet.

Unknown PC/Domain on network

  • Filter
  • Time
  • Show
Clear All
new posts

  • Unknown PC/Domain on network

    Hello guys,

    First off, sorry if I din't put this into the right category, but I wasn't sure.

    After we installed Sonic Walls application to monitor user internet activity, we notice a PC which had downloaded 400MB of MP3 data.

    After doing an NSlookup to this IP we have discovered it is on a totally different domain than ours. How can this be, a PC with our subnet IP and belong to a totally different domain?

    Any help with this is greatly appreciated.
    The IP address is and a nslookup brings back name that this IP belongs to is ABC_UI_PRIMARY, but we cannot find any PC on our network with that name.This is driving us crazy!
    Last edited by Mudd; 21st December 2010, 21:06. Reason: Added information

  • #2
    Re: Unknown PC/Domain on network

    Hi mudd,

    I am not sure how large your network is but, since you have the IP address you (or your NOC) may be able to track the host down by looking at the arp tables on your router(s) along the path to the mysterious host. To help with this, run a traceroute to for this. That is how I would handle something like this. It is a manual process and it will only work if the host is actively communicating. If someone else out here knows of a better way to hunt something like this down please share.

    just my $.02



    • #3
      Re: Unknown PC/Domain on network

      Do you have users who connect from home via VPN? If so, they're home workgroups will usually show up in Network Neighborhood or My Network Places.


      • #4
        Re: Unknown PC/Domain on network

        Can you access the admin share on the computer?

        If so, change the back ground paper to "CALL (Phone Number) if you see this". You should get a intresting call :P.

        If that is not pratical, how much access can you get to this machine? Can you broswe to it? Port scan it?

        Do you have a Wireless network? Is it in the range of your wireless network.

        Also, as a instant fix, you can find its NIC'x mac and block that.
        If in asking for more details about a problem I seem to be rude, think about it this way, If I did not have to ask, I would not of been forced to be rude.

        Please assume anything and everything I say to be wrong unless I have provided links and evidence, or you have done the same.
        IE: you blow your server up following my advice, not my bad

        A OP is bad if I can go to and answer the question by pressing 4 buttons. "Ctrl +c, Ctrl +v".


        • #5
          Re: Unknown PC/Domain on network

          I think joeqwerty may be right. For VPN connections in Control Panel there is an option in the Advanced TCP settings to 'Use default gatweway on remote network' (the office connection). Make sure your VPN users have this option unchecked.

          If it is checked (default setting) all their internet traffic is routed via your connection. It will also mean that their Internet speeds will rise dramatically while using the VPN connection.
          A recent poll suggests that 6 out of 7 dwarfs are not happy


          • #6
            Re: Unknown PC/Domain on network

            Thank you all for the your thoughts on the matter.

            Turns out to be a vendors domain/machine in which they have access to our network to update a software they support for us.

            We don't want to jump to blaming anyone and think they might have just forgot to disconnect their VPN conncection after they updated. That's just what we think happened.

            We will be relaying this to them and ask them to "uncheck" the "Use Default Gateway on Remote Networks" Option. (Thank you Blood for that.)

            And thank you everybody else for you valueable input, it's always very good advice.