A couple of our domain controllers have been connecting to IP addresses in the shared address space (100.64.0.0/10) over ports 139 and 445. They are using Google’s DNS server 8.8.8.8, and they are connecting to Microsoft, of course. These addresses in the shared address space should just be one of the hops, not the destination.
Do any of you guys know why we are seeing this network communication?
