Announcement

Collapse
No announcement yet.

IP Address conflict with reserved DHCP address

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • IP Address conflict with reserved DHCP address

    Hello, again

    I have a single domain that includes one W2k3 DC and one W2k8 DC. The W2k8 DC has only just been added to the domain. DNS, DHCP and WINS still reside on the W2k3 DC.

    This morning I turned on a WinXP client (\\Vicky) and it displayed a message saying there was an IP address conflict with another system on the network. I'm a little confused about this as all the clients get their addresses via DHCP and all the addresses are reserved. I use DHCP to assign addresses between 192.168.0.100 and 192.168.0.200.

    When I checked the System log for details it gave a MAC address for the system that had the duplicate address. But - I cannot find a device with this address. None of the reserved DHCP addresses match, and neither of the DC's have this address. I have also checked our printers, but like the DC's they have static addresses anyway that are outside the DHCP scope.

    I've checked the DHCP reservations on the DC and the conflicting address is properly assigned to the machine called \\Vicky.

    When I checked WINS, \\Vicky is assigned 192.168.0.120 as expected, but there is a workgroup entry, named after our domain, HTLINCS, that has the same address. Now, I have no idea what is going on here. I have never set up a Workgroup named after our domain.

    The only things that have changed recently on our network are that I have added two W2k8 servers. One was promoted to a DC. The other is going to be used as a file server. I set this up on our network but did not join it to the domain until I had prepared the W2k3 DC to accept the W2k8 DC.

    The screenshot shows the WINS entries that have the conflicting address.

    I'll change the reserved address for \\Vicky to resolve my immediate problem but if anyone can help me understand what has happened here I will be very grateful.

    Thanks
    Attached Files
    A recent poll suggests that 6 out of 7 dwarfs are not happy

  • #2
    Re: IP Address conflict with reserved DHCP address

    Can you look at the arp tables on your switch(es)? That would show you what port the offending mac address was connected to.

    You can also put the mac address in to this website and it might tell you the vendor of the NIC which might give you a clue as to what the device is. http://www.coffer.com/mac_find/
    Regards,
    Jeremy

    Network Consultant/Engineer
    Baltimore - Washington area and beyond
    www.gma-cpa.com

    Comment


    • #3
      Re: IP Address conflict with reserved DHCP address

      Hi, JeremyW

      Thanks for the advice.

      Our switches are unmanaged so I cannot see what is going on there. I checked our router's ARP cache and the offending entry is not listed. When the client was switched on, it showed the clients own MAC address/IP Address, but the other MAC address has not been listed so far.

      The weblink you provided returns a Dell brand name. However, all our computers, except one, are Dell machines.

      There are only 34 clients on the network. All except those assigned a static address (3) are listed in the DHCP reservations and I have looked at each of them. Of the remaining three, none have the same MAC address that appears in the event log entry.

      Additionally, when I set the servers up, I only use one of the network cards, and disable the others.

      My machine's ARP cache

      *=offending address

      Code:
      C:\Documents and Settings\blood>arp -a
      
      Interface: 192.168.0.114 --- 0x2
        Internet Address      Physical Address      Type
        192.168.0.2           00-1a-a0-0a-49-47     dynamic
        192.168.0.10          a4-ba-db-40-2f-79     dynamic
        192.168.0.23          00-00-00-00-00-00     invalid
        192.168.0.70          00-14-22-7a-11-96     dynamic
        192.168.0.95          00-50-7f-8e-50-08     dynamic
        192.168.0.120         00-26-b9-8b-ee-e9     dynamic*
        192.168.0.134         00-26-b9-8b-ee-e1     dynamic
      
      C:\Documents and Settings\blood>
      File server's ARP cache:
      Code:
      C:\Users\administrator.HTLINCS>arp -a
      
      Interface: 192.168.0.134 --- 0xa
        Internet Address      Physical Address      Type
        192.168.0.2           00-1a-a0-0a-49-47     dynamic
        192.168.0.10          a4-ba-db-40-2f-79     dynamic
        192.168.0.70          00-14-22-7a-11-96     dynamic
        192.168.0.95          00-50-7f-8e-50-08     dynamic
        192.168.0.114         00-1d-09-01-5f-4d     dynamic
        192.168.0.120         a4-ba-db-40-2f-7b     dynamic*
        192.168.0.255         ff-ff-ff-ff-ff-ff     static
        224.0.0.22            01-00-5e-00-00-16     static
        224.0.0.251           01-00-5e-00-00-fb     static
        224.0.0.252           01-00-5e-00-00-fc     static
        224.0.1.24            01-00-5e-00-01-18     static
        224.0.1.60            01-00-5e-00-01-3c     static
        239.192.152.143       01-00-5e-40-98-8f     static
        239.255.2.2           01-00-5e-7f-02-02     static
        239.255.255.250       01-00-5e-7f-ff-fa     static
        255.255.255.255       ff-ff-ff-ff-ff-ff     static
      
      C:\Users\administrator.HTLINCS>
      DC's ARP cache:
      Code:
      C:\Documents and Settings\administrator.HTLINCS>arp -a
      
      Interface: 192.168.0.2 --- 0x10003
        Internet Address      Physical Address      Type
        192.168.0.10          a4-ba-db-40-2f-79     dynamic
        192.168.0.30          00-1b-78-ec-2b-8b     dynamic
        192.168.0.60          00-00-00-00-00-00     invalid
        192.168.0.70          00-14-22-7a-11-96     dynamic
        192.168.0.87          00-0e-7f-31-6e-9a     dynamic
        192.168.0.95          00-50-7f-8e-50-08     dynamic
        192.168.0.101         00-1e-4f-c0-eb-95     dynamic
        192.168.0.102         00-16-76-96-5f-65     dynamic
        192.168.0.105         00-19-b9-42-7b-02     dynamic
        192.168.0.108         00-12-3f-61-a6-58     dynamic
        192.168.0.109         00-0c-f1-d9-9e-ac     dynamic
        192.168.0.110         00-11-43-b9-af-6e     dynamic
        192.168.0.112         00-1a-a0-06-23-ad     dynamic
        192.168.0.114         00-1d-09-01-5f-4d     dynamic
        192.168.0.116         00-0b-db-b1-cb-43     dynamic
        192.168.0.117         00-1e-4f-b8-5f-b4     dynamic
        192.168.0.119         00-12-3f-5f-a8-ae     dynamic
        192.168.0.120         00-26-b9-8b-ee-e9     dynamic*
        192.168.0.122         00-12-3f-5f-a6-b0     dynamic
        192.168.0.123         00-0c-f1-d9-ab-6d     dynamic
        192.168.0.125         00-18-8b-8a-2e-0c     dynamic
        192.168.0.126         00-0c-f1-d9-a8-6a     dynamic
        192.168.0.128         00-1e-4f-c8-47-c5     dynamic
        192.168.0.129         00-24-e8-2d-35-bf     dynamic
        192.168.0.131         00-25-64-bf-ee-78     dynamic
        192.168.0.132         00-25-64-bf-f0-70     dynamic
        192.168.0.133         00-25-64-bf-f0-31     dynamic
      
      C:\Documents and Settings\administrator.HTLINCS>
      2 and 10 are DC's, 70 is an old file server, 95 is the router. 30 and 87 are printers. 23 and 60 are defunct printers - rarely used.

      The DCHP reservations go from 100-135 (now excluding 120).

      What is now apparent is that the file server's ARP cache record for xx.120 is different to the others. The system log event on \\Vicky quoted 00-26-b9-8b-ee-e9, the file server quotes a4-ba-db-40-2f-7b which is also a Dell.

      Still, the problem with the address conflict is resolved. I just don't understand how this happened
      A recent poll suggests that 6 out of 7 dwarfs are not happy

      Comment


      • #4
        Re: IP Address conflict with reserved DHCP address

        Hmm, interesting.

        So do you have two mac addresses out there that you don't know who they belong to that are on .120 or is one of those mac addresses for Vicky?

        Since it's a dell machine what you could do is look in your reverse DNS zone and see what is assigned to the .120 address and see if that sparks anything for you. If not then you can delete the PTR records for .120 and then run a ping -a 192.168.0.120 and see if/what the host name that is returned.

        You can then try and run a port scanner to see what's open that may give you an indication of what device it is and if the SMB ports are open you can try \\192.168.0.120.

        Well, that's all if you still need to track down the conflict.
        Regards,
        Jeremy

        Network Consultant/Engineer
        Baltimore - Washington area and beyond
        www.gma-cpa.com

        Comment


        • #5
          Re: IP Address conflict with reserved DHCP address

          Thanks again for responding.

          Originally posted by JeremyW View Post
          Hmm, interesting.

          So do you have two mac addresses out there that you don't know who they belong to that are on .120 or is one of those mac addresses for \\Vicky?
          Both the .120 MAC addresses are a mystery. I cannot associate either of them with a computer on the network. The address for \\Vicky is 00-1e-90-84-2b-0d

          Originally posted by JeremyW View Post
          Since it's a dell machine what you could do is look in your reverse DNS zone and see what is assigned to the .120 address and see if that sparks anything for you. If not then you can delete the PTR records for .120 and then run a ping -a 192.168.0.120 and see if/what the host name that is returned.
          When the error first appeared I check the PTR records and .120 was assigned to vicky.htlincs.local. I also tried pinging both .120 and vicky and vicky.htlincs.local with -a and it failed - 100% packet loss. I tried pinging from my client and from \\Vicky.

          Since changing the reservation for \\Vicky and starting it to get the new address, the PTR record no longer exists. It has also gone from the forward lookup zone.

          Subsequent pings for .120 fail.

          Originally posted by JeremyW View Post
          You can then try and run a port scanner to see what's open that may give you an indication of what device it is and if the SMB ports are open you can try \\192.168.0.120.

          Well, that's all if you still need to track down the conflict.
          Thanks. The conflict is resolved, but I will keep an eye the ARP cache and see if it continues to be populated with the .120 entry. If it does, I'll try what you suggested.

          Cheers!

          [Edit]
          I just pinged .120 and it responded... using the -a parameter does not result in a machine name being listed in the output. And neither DNS nor WINS contain entries for .120

          Weird.
          Last edited by Blood; 28th April 2010, 12:35. Reason: extra info
          A recent poll suggests that 6 out of 7 dwarfs are not happy

          Comment


          • #6
            Re: IP Address conflict with reserved DHCP address

            Just did a port scan using a free tool and it reports that three ports are open (see attachment). When I ran it again about an hour later, only two were open (22 and 80).
            Attached Files
            A recent poll suggests that 6 out of 7 dwarfs are not happy

            Comment


            • #7
              Re: IP Address conflict with reserved DHCP address

              Try and log on to the device using a browser.
              http://192.168.0.120

              22=SSH
              80=HTTP
              443=HTTPS

              EDIT: haha, just looked at the screenshot and it says what the ports are.
              Regards,
              Jeremy

              Network Consultant/Engineer
              Baltimore - Washington area and beyond
              www.gma-cpa.com

              Comment


              • #8
                Re: IP Address conflict with reserved DHCP address

                Whoops - sorry, forgot to mention that I had tried that.

                I have tried connecting to the device via My Computer \\192.168.0.120 . When I tried connecting via http I received a message saying that the certificate for the site could not be trusted. When I clicked continue anyway, the page failed to load.
                A recent poll suggests that 6 out of 7 dwarfs are not happy

                Comment


                • #9
                  Re: IP Address conflict with reserved DHCP address

                  Hmm, well it seems to be some Dell device that has a web interface and SSH console.

                  Have you tried connecting using SSH? You could use something like Putty to do that.
                  Regards,
                  Jeremy

                  Network Consultant/Engineer
                  Baltimore - Washington area and beyond
                  www.gma-cpa.com

                  Comment


                  • #10
                    Re: IP Address conflict with reserved DHCP address

                    Hmm, I may have figured it out. Happen to be at a client today installing a new Dell server and I noticed that the iDRAC comes configured with an IP address of 192.168.0.120.

                    So check to see if your server's iDRAC NICs are plugged in.
                    Regards,
                    Jeremy

                    Network Consultant/Engineer
                    Baltimore - Washington area and beyond
                    www.gma-cpa.com

                    Comment


                    • #11
                      Re: IP Address conflict with reserved DHCP address

                      Argle!

                      Well done. That must be it.

                      I have never accessed the iDRAC interface before, but according to the documentation I have just been reading I can configure it to grab an address via DHCP.

                      And now I understand why I could not access it. When I use:

                      https://192.168.0.120

                      it works fine.

                      Just need to figure out how the PowerEdge server that has a static IP Address of 192.168.0.10 assigned to the single enabled NIC can be connected to via .120. That's something I'll look into after I have transferred all our programs data to the PowerVault we have just acquired.

                      Thank you very much for all your help. I thought I was going mad.

                      A recent poll suggests that 6 out of 7 dwarfs are not happy

                      Comment


                      • #12
                        Re: IP Address conflict with reserved DHCP address

                        Glad to help!

                        Depending on the PowerVault model, it's possible that it has an iDRAC port too so be sure to check it as well.

                        Cheers!
                        Regards,
                        Jeremy

                        Network Consultant/Engineer
                        Baltimore - Washington area and beyond
                        www.gma-cpa.com

                        Comment

                        Working...
                        X