0

Running netstat -r we got results as below. Our IP range does not include what the netstat results show, namely the .155 portion.

   Active Routes:
   {removed irrelevant results}
   192.168.155.160  255.255.255.240         On-link   192.168.155.161   5256
   192.168.155.161  255.255.255.255         On-link   192.168.155.161   5256
   192.168.155.175  255.255.255.255         On-link   192.168.155.161   5256
   {removed irrelevant results}
   255.255.255.255  255.255.255.255         On-link   192.168.155.161   5256

Our router sets the range to 192.168.111.100 through .150.

Where is this 192.168.155.x coming from? The process using it is ntoskrnl.exe.

Yes, for those of you inclined to slam folks that ask here, yes Googled it (and Duck Duck Go) - Nada.

What is this thing?

6
  • You got a device on the LAN running a DHCP service? Like a Cisco spider phone or some conferencing kit? – spikey_richie Jun 18 '19 at 15:15
  • Nothing on the LAN running a DHCP service. Microsoft Windows Server 2012 R2 in as plain vanilla as can be. Small biz with a few PCs, all Windows 10 current (as if we had a choice), some iPhones and iPads, that's it. Router serves as DHCP server running dd-wrt. – SKidd Jun 18 '19 at 15:21
  • Can you get a host name from it with tracert? – spikey_richie Jun 18 '19 at 15:25
  • Not sure what you mean, tracert what? How is tracert on the router IP or server IP going do do anything? Care to provide the command that this will help? – SKidd Jun 18 '19 at 16:24
  • And as a Duh, doing hostname in a cmd window is correct, – SKidd Jun 18 '19 at 17:18
0

Turns out this "rogue address" is courtesy of the Hyper-V Virtual Ethernet Adapter. In our case it assigns itself 192.168.155.161, and an internet address of 192.168.155.175.

Doing a tracert on 192.168.155.161 resolves it to pcname.mshome.net, namely a new domain. mshome.net is a live IP at 104.215.95.187 belonging to Microsoft per ARIN.

Why enabling Hyper-V has to use a Microsoft domain that's live with traffic on it via ntoskrnl.exe with nothing using it is a whole other question. Anyone with thoughts feel free to comment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.