We have a nuber of PCs in various subnets that are attempting to try and access LIFs on our CDOT cluster that are in various part of our enterprise that they shoud have no reason to access and we can't figure out why.
For example, the cluster has a LIF with an IP of 172.19.240.7 /20 and that LIF is in an isolated VLAN that PCs do not have any direct connectivity to. However, a Windows PC with an IP of 172.21.133.25 /24 is for some reason attempting to access the IP of that LIF. When looking at "netstat -ano" on the PC, we see:
Protocol Local Address Foreign Address State PID
TCP 172.21.133.25:58905 172.19.240.7:135 SYN_SENT 2976
With PID 2976 being "Service Host: Network Service - Workstation". While DFS does point to some shares on the NetApp cluster, none of them are on the node to which 172.19.240.7 is associated.
There are three other LIFs on the cluster (all similar to the one noted above in that PCs don't have connectivity to them, but the PCs are trying to contact the IP addresses of those LIFs). What can we check to try and figure out what is attempting all of these connections?