One virtual machine on my network is constantly trying to authenticate to the server. It is moving between many different ports in rapid succession, and the source is always the same IP, which is an internal IP(192.168.x.x). I have identified the particular virtual machine, but that is where my investigation has stopped. Ports used are around 4150-4220.
I am wondering if anyone has experienced this, and any suggestions as to the potential culprit application that would be doing this. Or maybe it is not an application?
I am using Windows Server 2003, and the offending virtual machine is using Windows XP Professional.