Help with these odd 192 IP's showing up in my netscan

[compudoc]

Hey guys thanks in advance for your help with this question, not sure if i am looking at some bad activity or just what?

When I use Angry IP scanner on this office's network that I am installing some new PC's and perform a scan in its random mode setting (looking at different addresses in the 192 sub-net i think?) I am seeing some VERY weird replies from boxes not on this network but what appears systems that could or maybe are able to access this "private" subnet - I have attached a few of the random scans for your viewing pleasure and hope to get your opinions on WTF this is

 

[System Error Message]

what router do you use and did you block forwarding from class B and C adddresses you dont use?

 

[compudoc]

Sorry forgot to give better details - Network provider = ATT with 381HGV / Asus RT-AC66U

Asus RT-AC66U router is behind the ATT U-Verse 381HGV Modem/router that I have it set to pass all ports (setting at the bottom of the ATT advance firewall settings page) to the MAC address of the Asus router.

The 381 is plugged into the Asus WAN port with all clients connected to the wired ports on the AC66

 

[compudoc]

what router do you use and did you block forwarding from class B and C adddresses you dont use?

No I did not block the forwarding from the B/C addresses (not sure how to do this?)

 

[coxhaus]

You have a lot of class B networks showing up. What is your network scope? This is probably defined on your DHCP server. What do the different colors means on the random scans? Are you scanning beyond your network? Check your network scope in the scanning software.

 

[System Error Message]

RMerlin firmware has configurable firewall, other than that cisco, juniper, mikrotik and pfsense have them too. Its not professional to use a consumer router in an office environment. How can you not know what ip address your network is using? You should already know your network architecture, layout and configurations. I specifically remember all these manufacturers claiming their products for homes/SOHO not SMEs.

Using RMerlin's firmware you create a bunch of rules to drop forwarding at scr-nat from class B and below IPs that are not your network.