My internal time server is working correctly, except for two strange NTP
queries coming from non-existent local IP addresses. Trace in w32time.log
indicates that listening thread shows query from 192.168.182.1:123 and
192.168.206.1:123.
There is no IP address on our network on these subnets. Have stopped all
non-microsoft services on time server and the queries continue.
Have searched registry and I find only the correct external time source
listed in the w32time configuration parameters. Can find no reference to
above IP addreses when searching registry or on text search of server.
Anybody have any idea about where to look next for the source of these
phony time queries?
- thanks
Dave