Question : Tracking down rogue computer on network

Greetings,

I recently started seeing the following entry in the System Log of my W2k domain controller:

Source: MRxSMB
Category: NONE
Type: Error
Event ID: 8003

"The master browser has received a server announcement from the computer INTERN that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D67B5416-646D-4582-B9. The master browser is stopping or an election is being forced. "

I've read that you can resolve this issue by turning off the Computer Browser service on the offending workstation.  This may or may not be true.  The problem is that I can not locate this machine to try it.

The computer INTERN is not a member of my domain (i can't find it in the Active Directory listing), but this is not to say that it might not have been  at one point.  It is also not in the dns entries of my domain controller.

The strange thing is that if I go to start > search > a computer on the network   and put in INTERN, it pops up a machine listed under the same folder as the machines in my domain.  Thing is that if I right-click on it and go to properties i get the message "The server Intern could not be found on the network".  Also, a simple ping results in "Ping request could not find host intern. Please check the name and try again."

Does anyone know of a way to track this machine down?  Perhaps a way to get an ip address somehow?  Or maybe a way to go from ip address to hostname.

One of the complicating factors is that we have 4 sites vpn'd together, each site having it's own subnet.  2 of these sites are over an hour's driving time away.

Any help with this issue would be greatly appreciated

Answer : Tracking down rogue computer on network

Maybe you could use Ethereal or some other protocol analzer to track network traffic. It will show you IP addresses, domain names, mac addresses,etc. You can set it up to write to a file, or you can track in real time...and zero in on specific traffic.