STAS WMI Attempting to Access Non-Existant Devices

JonathanBell,

are you using STAS through VPN tunnel?

Also from console, what is the output of this command?

system auth cta show

Thanks

STAS is local, the DC and UTM are on the same physical LAN.

The console command comes up with everything showing correct. Status/Collector enabled with correct IP/Port/Group. VPN both listed as '-'.

I should also note that STAS is working properly as far as login/logout detection.

That IP address is a self assigned one, so one of the devices on your network has not connected properly to the network and received a legitimate IP address.

That IP address is a self assigned one, so one of the devices on your network has not connected properly to the network and received a legitimate IP address.

rfcat_vk is right.

Use TCPDUMP on XG or better on AD to understand who is the machine with multiple IP. Apipa on latest windows version comes even from Windows Server Cluster.

Regards

Im unsure of the two replies mentioning APIPA. If a device has a 169.254 address, its obviously not connected to the network. So where is STAS getting this address from to check against? That's my question. Obviously if a machine has an APIPA address it is NOT communicating with my domain controller.

To clarify further, this is not a single address issue. We are seeing dozens upon dozens of bogus IP addresses being attempted by STAS. None of which are a part of our network.

Did you ever get this resolved?

I am starting to see countless 10009 event ids with STAS ver 2.5.1.0 on Win 2008 R2 DCs starting to appear all of a sudden with no explanation.

Hi GreenVomit8 and JonathanBell 

STAS will generate WMI query to Network Not Monitored by Agent/collector in some situations and due to that it will trigger DCOM error under server event viewer.

As of now it is expected behavior with current STAS version.

This will be going to fixed in STAS3.0 (future STAS release) but as of now unfortunately no timeline and no information with us when this will be in the Dev team road-map.