As I mentioned, the IP isn't monitored at all in NPM. I ran Microsoft's Network Monitor and was able to trace the traffic back to a svchost.exe process handling DCE Endpoint resolution; unless I'm mistaken this appears to be the process used by SAM when checking different application polls? If I run Process Explorer, I see the TCP/IP for that process light up like a Christmas tree when polling is going on.
↧