Windows Time Service going to non-local IP?

Phil McNeill · External Since: Mar 19, 2007 Posts: 2

Hi,

Since Friday roughly 30 PCs on my network of 600 have been sending traffic
to 157.184.0.2 via TCP port 123 (NTP). I am seeing this traffic being
dropped outbound at my firewall and each PC is generating it every 15
seconds. I don't understand why they would all of a sudden start doing
this. I don't see any rogue processes or services running, and if I turn
off the Windows Time Service on the PC, it stops sending the traffic.

Any ideas on what would cause this to pop up all of a sudden on a small
percentage of PCs? Possible that a common print driver could cause this? I
see references to that IP range being the default for some Lexmark printers.

Thanks for any thoughts!

Phil

Robert Jacobs · External Since: Mar 19, 2007 Posts: 2

On Mar 19, 4:25 pm, "Phil McNeill"
<philmcne... DeleteThis @REMOVETEXTINCAPShydroottawa.com> wrote:
> Hi,
>
> Since Friday roughly 30 PCs on my network of 600 have been sending traffic
> to 157.184.0.2 via TCP port 123 (NTP). I am seeing this traffic being
> dropped outbound at my firewall and each PC is generating it every 15
> seconds. I don't understand why they would all of a sudden start doing
> this. I don't see any rogue processes or services running, and if I turn
> off the Windows Time Service on the PC, it stops sending the traffic.
>
> Any ideas on what would cause this to pop up all of a sudden on a small
> percentage of PCs? Possible that a common print driver could cause this? I
> see references to that IP range being the default for some Lexmark printers.
>
> Thanks for any thoughts!
>
> Phil

Wierd. Do you have a group policy setup to use a specific server for
ntp? Our company has a GP for the domain controllers to be ntp
servers, and the machines at each location are setup as ntp client
pointing to the local DC. What does your setup look like? Do you
need help setting up ntp servers and clients via ntp?

Look here for some info:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technol...es/secu

Good luck!

Robert Jacobs · External Since: Mar 19, 2007 Posts: 2

On Mar 19, 4:49 pm, "Robert Jacobs" <robertjacob....DeleteThis@gmail.com> wrote:
> On Mar 19, 4:25 pm, "Phil McNeill"
>
>
>
>
>
> <philmcne....DeleteThis@REMOVETEXTINCAPShydroottawa.com> wrote:
> > Hi,
>
> > Since Friday roughly 30 PCs on my network of 600 have been sending traffic
> > to 157.184.0.2 via TCP port 123 (NTP). I am seeing this traffic being
> > dropped outbound at my firewall and each PC is generating it every 15
> > seconds. I don't understand why they would all of a sudden start doing
> > this. I don't see any rogue processes or services running, and if I turn
> > off the Windows Time Service on the PC, it stops sending the traffic.
>
> > Any ideas on what would cause this to pop up all of a sudden on a small
> > percentage of PCs? Possible that a common print driver could cause this? I
> > see references to that IP range being the default for some Lexmark printers.
>
> > Thanks for any thoughts!
>
> > Phil
>
> Wierd. Do you have a group policy setup to use a specific server for
> ntp? Our company has a GP for the domain controllers to be ntp
> servers, and the machines at each location are setup as ntp client
> pointing to the local DC. What does your setup look like? Do you
> need help setting up ntp servers and clients via ntp?
>
> Look here for some info:http://www.microsoft.com/technet/prodtechnol/windowsserver2003/techno...
>
> Good luck!- Hide quoted text -
>
> - Show quoted text -

I meant to say "Weird" not "Wierd"

Ray · External Since: Mar 20, 2007 Posts: 8

Lexmark is probably phoning home to report on how often you're printing.
Lexmark is assigned that IP block.

Ray

"Phil McNeill" <philmcneill.TakeThisOut@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:%23NkWf0maHHA.4788@TK2MSFTNGP04.phx.gbl...
> Hi,
>
> Since Friday roughly 30 PCs on my network of 600 have been sending traffic
> to 157.184.0.2 via TCP port 123 (NTP). I am seeing this traffic being
> dropped outbound at my firewall and each PC is generating it every 15
> seconds. I don't understand why they would all of a sudden start doing
> this. I don't see any rogue processes or services running, and if I turn
> off the Windows Time Service on the PC, it stops sending the traffic.
>
> Any ideas on what would cause this to pop up all of a sudden on a small
> percentage of PCs? Possible that a common print driver could cause this?
> I see references to that IP range being the default for some Lexmark
> printers.
>
> Thanks for any thoughts!
>
> Phil
>

Phil McNeill · External Since: Mar 19, 2007 Posts: 2

"Ray" <n/a> wrote in message news:uYWjcTvaHHA.5108@TK2MSFTNGP03.phx.gbl...
> Lexmark is probably phoning home to report on how often you're printing.
> Lexmark is assigned that IP block.
>
> Ray

The "why" is not cofirmed, but it did come down to a blabbermouth Lexmark
printer. Killed it, problem solved.

Ray · External Since: Mar 20, 2007 Posts: 8

You really have to wonder what these vendors are doing. We installed several
Zebra label printers and they're all trying to go to dozens of URLs on the
Internet with the time-tcp protocol.

There is nothing on the printer that does a timestamp. There's nothing
exposed in the interface for time servers and the vendor swears they're not
doing it.

I really wonder where they're getting their firmware and how closely they
are (not) auditing what it does.

Ray

"Phil McNeill" <philmcneill.DeleteThis@REMOVETEXTINCAPShydroottawa.com> wrote in
message news:erVmFfXcHHA.4864@TK2MSFTNGP05.phx.gbl...
>
> "Ray" <n/a> wrote in message news:uYWjcTvaHHA.5108@TK2MSFTNGP03.phx.gbl...
>> Lexmark is probably phoning home to report on how often you're printing.
>> Lexmark is assigned that IP block.
>>
>> Ray
>
> The "why" is not cofirmed, but it did come down to a blabbermouth Lexmark
> printer. Killed it, problem solved.
>
>
>