Unknown Connections To This Computer

January 27, 2014 at 18:37:11
Specs: Windows XP, Intel Quad/4096
So I set up a rule in PeerBlock to observe certain things.

I blocked all the local IP numbers on my network (ranging from -, except for which is this computer's IP number, and, which is the router's IP number). So PeerBlock blocks 2 unknown IP numbers ( & attempting to connect using port 137. Sometimes it's only once every moment, and sometimes 4 to 5 times within a few seconds or so.

I went to the router's settings (at, yet those two IP numbers are Not listed in the devices that are connected to the router.

So what are these devices and why do they keep attempting to connect to this computer?

Thank you for reading/helping me with this.

See More: Unknown Connections To This Computer

Report •

January 27, 2014 at 19:51:37


Report •

January 27, 2014 at 23:29:08
Find the MACs associated with those addresses, using "arp". Check which manufacturer those MACs belong to. That might help you identify the addresses.

Do you have any devices in the house other than the computer and the router? Smart TVs, tablets, that sort of thing?

Report •

January 27, 2014 at 23:49:19
Hi ijack, thank you for the reply. There's a phone that's connected through the router, that may resolve one of the IP numbers, I totally forgot about it, thank you for mentioning that. But I did a little research to figure out what this whole ARP deal is, and I remember using this in the past, just forgot how to use it really.

I'm in cmd.exe and I'm trying many different switches to get this arp to list all the IP numbers in the network. I can only get to the stage for it to list the router's IP number only. You wouldn't happen to know how to use it, so I don't have to go online researching and trying so many different things?

Thanks for your response .

Report •

Related Solutions

January 28, 2014 at 00:32:29
arp -a

should list all the IP devices that it knows of. You may need to ping the address first.

Report •

January 28, 2014 at 08:31:04
Okay, thanks for the reply. I did have to ping the addresses first. So this is what I found.

Interface: --- 0x10003
Internet Address Physical Address Type 00-1d-d6-28-53-81 dynamic b4-b5-2f-16-38-d3 dynamic 90-e6-ba-a5-56-cd dynamic

• I don't know what .3 is; can't find it on Google... I'm assuming it's the phone
• For .7, it says it's from an ASUS board... which is what board I'm using for this computer.
• I manually looked up my motherboard's (ASUS board) MAC address at, which I cannot get listed with the arp command... it is: 60-A4-4C-B5-22-F5

I pinged all:
Reply from bytes=32 time=53ms TTL=255
Reply from bytes=32 time=1ms TTL=255
Reply from bytes=32 time=1ms TTL=255
Reply from bytes=32 time=1ms TTL=255

Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128

Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128
Reply from bytes=32 time<1ms TTL=128

So here's the weird thing... this computer is the only ASUS board on the network. And look at the ping time from .7 and .26 (.26 is this computer), they're less than 1ms... Is .7 this computer's board also???

Why is there two ASUS boards connected to the network?

Report •

January 28, 2014 at 12:04:09
I think port 137 is used for file sharing. If you don't use file sharing turn it off and see if it helps.

Always pop back and let us know the outcome - thanks

Report •

January 28, 2014 at 13:17:48
B4-b5-2f is Hewlett-Packard. Do you have a networked printer?

Report •

January 28, 2014 at 17:11:13
Derek: I don't use file sharing on the network. How do I turn that port off?
ijack: Yes sorry, I was multi-tasking and yes you're right, that MAC address is the HP printer that's connected to the network. So yes, is the printer. Yet, my question is about the IP number. It also tries connecting using port 137, and I believe I have seen it use port 138 or 139 as well. So how do I figure out what is?

Report •

Report •

January 28, 2014 at 23:56:29
It's probably your phone as you haven't accounted for that. That would fit in with it being ASUS, as they make mobile phones and, no doubt, components for other manufacturers.

Report •

January 29, 2014 at 19:13:22
• Johnw: thank you for the suggestion for that program, I remember getting my hands on that a while ago, and forgot about it, now I get to keep this program, it's great. I had a similar program but it did something that make the graphics really slow and messed up something weird (my Windows Restore always tends to mess up to where I can never use that feature again, even after every time I reformat the computer... I don't know what messes it up... System Distribution Service 3.0? What is that anyways? This is my personal computer at home). But the program that was similar to the one you mentioned is: Windows Worms Doors Cleaner 1.4.1.
• ijack: It's not the smart phone (HTC Inspire), I actually finally figured what computer. It's an HP computer in the house. It's in its original state, why is it identifying it as an ASUS motherboard? Why is the ping always less than 1ms? My computer has an ASUS board and my ping is less than 1ms... is this IP 'masking' my computer from having some other duplicate 'fake' interface from itself?

message edited by pepanee

Report •

January 29, 2014 at 23:16:04
The fact that the computer is manufactured by HP doesn't mean that it's motherboard is. Either it's made by Asus for HP or the NIC is.

Ping times of <1 ms are perfectly normal on a lightly used LAN. There is nothing untoward in your network.

Report •

Ask Question