It is almost certainly doing something important like running the checkout database. You can also look at the librarian and checkout machines for clues. Netsta

It is almost certainly doing something important like running the checkout database. You can also look at the librarian and checkout machines for clues. Netstat one of those and you’ll probably see persistent outbound connections to your mystery server. If that’s not a viable path for some reason (such as you’re not actually allowed to be doing this) It probably has a static IP. Find the dhcp server, check the range. It’s probably avoiding high numbers in the cidr so handing out 192.168.0.2-99 the server is probably some easy to remember address like 100 or 200. (Some sysadmins avoid low numbers and put servers at 2-10 so checking the range is a must) you can probably infer it from the dhcp address you get when you join, (probably somewhere in the 20s or 60s) some idiots put their gateway at the last address and count down (looking at you Comcast) but that was less common ten and twenty years ago. If you’re going full black box I’d scan the whole range and find addresses that look like servers and once identified port scan them for listening services. Look for standard ports like dbs (is this a windows shop? Is it an access database?) also look for web servers and webserver alt ports like 8080