Finder via nmblookup?

[Tesselator]

 

I restarted my Mac Pro 1,1 x5355 from bootcamp and when OS X (10.5.8) finished loading Little Snitch popped up this requester:

 

 

 

I know that the nmblookup program resolves NetBIOS names into IP addresses and I've found out that 172.16.xxx.xxx is probably some kind of local VPN or something from reading these:

 

http://who.is/whois-ip/ip-address/172.16.186.255/

https://www.arin.net/knowledge/rfc/rfc1918.txt

 

RFC 1918 Address Allocation for Private Internets February 1996

 

3. Private Address Space

 

The Internet Assigned Numbers Authority (IANA) has reserved the

following three blocks of the IP address space for private internets:

 

10.0.0.0 - 10.255.255.255 (10/8 prefix)

172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

What I don't know tho and what I would like to find out, is what's happening here and why? This is the first time in 3 years of use that I've seen such a requester. Searching the internet for "Finder via nmblookup" yields everything from "It's needed, allow it" to "The government is spying on you, run for your life". Anyone know what's happening and why?

 

PS: Please speak simple english - I suck at networking and network acronyms.

 

Thanks!

[Tesselator]

OK, I think I have this almost sussed. Here's what I've found out:

 

Parallels and VMware set up two virtual network adaptors. Running ifconfig resulted in this these listings:

 

vmnet8: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500

inet 172.16.79.1 netmask 0xffffff00 broadcast 172.16.79.255

ether 00:50:56:c0:00:08

vmnet1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500

inet 172.16.185.1 netmask 0xffffff00 broadcast 172.16.185.255

ether 00:50:56:c0:00:01

 

"Vmnet adapters are virtual adapters used to either NAT your VM's to your local network or give your VM's host-only access. In VMware vmnet8 is the NAT adapter, vmnet1 is the host-only network adapter." Source: Toby G. Message 12

 

Evidentially Finder in an attempt to populate the "Shared" section of the sidebar is scanning the virtual network adaptor IP addresses for resources, servers, etc.. This alerts Little Snitch and up comes the requester. At least this is the best explanation I've come up with so far. If correct allowing it or disallowing it is only the difference between a potential entry in the Shared section of the sidebar. Likewise everything seems to be locally contained and no information is being sent over the internet. A more prudent snooper would be needed to know for sure but that's what it looks like.