Running netstat -r we got results as below. Our IP range does not include what the netstat results show, namely the .155 portion.

   Active Routes:
   {removed irrelevant results}         On-link   5256         On-link   5256         On-link   5256
   {removed irrelevant results}         On-link   5256

Our router sets the range to through .150.

Where is this 192.168.155.x coming from? The process using it is ntoskrnl.exe.

Yes, for those of you inclined to slam folks that ask here, yes Googled it (and Duck Duck Go) - Nada.

What is this thing?

  • You got a device on the LAN running a DHCP service? Like a Cisco spider phone or some conferencing kit? – spikey_richie Jun 18 '19 at 15:15
  • Nothing on the LAN running a DHCP service. Microsoft Windows Server 2012 R2 in as plain vanilla as can be. Small biz with a few PCs, all Windows 10 current (as if we had a choice), some iPhones and iPads, that's it. Router serves as DHCP server running dd-wrt. – SKidd Jun 18 '19 at 15:21
  • Can you get a host name from it with tracert? – spikey_richie Jun 18 '19 at 15:25
  • Not sure what you mean, tracert what? How is tracert on the router IP or server IP going do do anything? Care to provide the command that this will help? – SKidd Jun 18 '19 at 16:24
  • And as a Duh, doing hostname in a cmd window is correct, – SKidd Jun 18 '19 at 17:18

Turns out this "rogue address" is courtesy of the Hyper-V Virtual Ethernet Adapter. In our case it assigns itself, and an internet address of

Doing a tracert on resolves it to pcname.mshome.net, namely a new domain. mshome.net is a live IP at belonging to Microsoft per ARIN.

Why enabling Hyper-V has to use a Microsoft domain that's live with traffic on it via ntoskrnl.exe with nothing using it is a whole other question. Anyone with thoughts feel free to comment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.