in the Network folder of all Windows computers and in the output of smbtree command I see a lot of devices with strange names (legitimate names obfuscated with #).
WORKGROUP
\\WEBSERVER
\\RNPA82FE9
\\RNP002673AB3150
\\RNP002673AB3141
\\RNP002673AB313C
\\RNP002673AB310B
\\RNP002673AB3103
\\RNP002673AB30DD
\\RNP002673AB2F7A
\\RNP002673AB2F4B
\\RNP002673AB2E86
\\RNP002673AB2DFD
\\RNP002673AB2DFB
\\RNP002673A85831
\\RNP002673A857D0
\\PC-######
\\#######-PC
\\FR######
\\DESKTOP-#####
\\BRN008077576ADE
\\BRN008077510CFD
We are in a 192.168.0.X network and arp-scan, nmap, nbtscan, and even nmblookup failed to find anything related to these names:
name_query failed to find name RNPA82FE9
name_query failed to find name RNP002673AB3150
name_query failed to find name RNP002673AB3141
name_query failed to find name RNP002673AB313C
This is a very simple network, there are:
- 7 PC (some linux and some windows, some in wireless and some wired)
- some Android phones
- a couple of iPhones
- one or two printers
- 6-7 voip Snom phones
- a Cisco access point
The network is connected to a virtual machine with Endian Firewall that acts as firewall towards internet and as router for another network with a domain controller and a file server. The domain name on the domain controller is not WORKGROUP.
Any idea? Where does this information is read from?
Obviously I double cheched but the RNP* strings are not the name of anything in the network and the numbers are not related to any mac address (even if they seem mac addresses).
Thank you for any help.