Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has Tell

It does that approx. 2 times a second and asks for a lot of 192.168.0.x addresses where x is in the range 0 to 30.

I'm wondering what program that would do something like that?

Also I'm wondering if there could be a security problem involved.

The PC in question runs windows 7.

  • Check if the requests are sent by some sharing apps, like Windows sharing and windows media extender. Also try to find the process or service that is using the network by looking at resource monitor. – Emadeddin May 16 '16 at 10:02
  • From memory, the old SMB model would do this in the absence of a domain controller. It implies that you've got a very old version of MSWindows running somwhere which should be retired/upgraded. – symcbean May 16 '16 at 11:56

A lot of home networking "helper" apps, for network printers, network webcams, etc. will continuously scan the local network looking for devices. Some network appliances will too, like NAS devices, for similar reasons (looking for local printers). Is the device doing the scanning a Windows PC with a bunch of typical desktop apps installed? That would be the first place to look (after you simply identify which host it is doing the scanning). It is interesting that it's focusing on 0-30 instead of the entire local subnet, though. That sounds more like software looking for a device on a default IP to help with first-time configuration.

To get to the bottom of it, look at what happens when it does find a device (assuming you are using wireshark from inside that zone it's searching) to see, is it trying to open a specific port? A range of ports? Does it do nothing?

| improve this answer | |
  • Windows 7 PC. I'll try to check if it is related to the network printer. From type to time my network printer is lost on the network (needs reboot to get back). Maybe this specific PC then starts scanning for it and keeps on and on as the printer is gone. However, no other PC on the net does that but it may be some special SW on this specific PC. Thanks for the tip. – 4386427 May 16 '16 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.