IP Address Conflicts

[gbtb]

We are currently getting lots and lots of IP conflicts on our network, running DHCP Find shows us that an IP of 71.66.73.84 is giving out IP Addresses, running a TRACERT gives us the following Tracing route to voip-71-66-73-84.neo.rr.com [71.66.73.84].

We are guessing it may be a virus on a computer, does anybody know of a way we can track down which computer it may be residing on?

The main problem is that this rougue DHCP server is handing out the IP address of our servers which is causing them to go down.

[Mr.Ben]

I've had a similar problem twice...

It was down to a staff member plugging a network cable from my network into a port desiganted for the Voice over IP system at one end, and my network on the other, but I recognised the problem from the dhcp server name (which was the local government VOIP system).

I've also seen this when another staff member plugged a network cable into the spare port on one of the phones.

In both cases it was a case of switching off portions of the network until I could trace where it was coming from.

The only question that I have to ask is why a voip system would be configured on the same address range as your network.

[gbtb]

Our network is configured with a totally different IP address range (10.121.*.*)

Also the software is showing up one of our previous DHCP servers is offering IP Addresses out addresses.

[Mr.Ben]

Has the previous DHCP server been plugged back in?

[gbtb]

The previous DHCP server is our current PDC.

However on just having a thought... we have turned it off over our lunch period now to test the effects and the IP which releates to the server is still handing out requests.

This leads us to believe another pc/laptop whatever it may be must also have the IP.

[GrumbleDook]

I'm afraid you will have to be methodical about this.

1 - try and find the MAC address of the originating box. This can help tie down possible location of the offending device ... especially if you record MAC addresses in your inventory. however, it may be spoofing the MAC address.
2 - Manually segment your network. Pull the plug on wireless first (in case something has your wireless key) and then slowly pull each link to your core switch. Have a machine directly attached to your core switch and renew DHCP every minute or so.
3 - Once you have identified the offending uplink to the core go to the switch stack connecting to that link. Have a look at which ports have a lot of traffic on them and then disable the ports, one by one. The other option is to do it by pulling network leads out if you cannot identify the port with *lots* of traffic on it.

Some network tools can help track this down but it really does depend on having them set up prior to an event in most cases.

HTH