Wireless Networks Thread, IP Address Conflicts in Technical; We are currently getting lots and lots of IP conflicts on our network, running DHCP Find shows us that an ...
28th June 2010, 11:44 AM #1
- Rep Power
IP Address Conflicts
We are currently getting lots and lots of IP conflicts on our network, running DHCP Find shows us that an IP of 18.104.22.168 is giving out IP Addresses, running a TRACERT gives us the following Tracing route to voip-71-66-73-84.neo.rr.com [22.214.171.124].
We are guessing it may be a virus on a computer, does anybody know of a way we can track down which computer it may be residing on?
The main problem is that this rougue DHCP server is handing out the IP address of our servers which is causing them to go down.
IDG Tech News
28th June 2010, 11:52 AM #2
I've had a similar problem twice...
It was down to a staff member plugging a network cable from my network into a port desiganted for the Voice over IP system at one end, and my network on the other, but I recognised the problem from the dhcp server name (which was the local government VOIP system).
I've also seen this when another staff member plugged a network cable into the spare port on one of the phones.
In both cases it was a case of switching off portions of the network until I could trace where it was coming from.
The only question that I have to ask is why a voip system would be configured on the same address range as your network.
Last edited by Mr.Ben; 28th June 2010 at 11:55 AM.
28th June 2010, 12:03 PM #3
- Rep Power
Our network is configured with a totally different IP address range (10.121.*.*)
Also the software is showing up one of our previous DHCP servers is offering IP Addresses out addresses.
28th June 2010, 12:18 PM #4
Has the previous DHCP server been plugged back in?
28th June 2010, 12:45 PM #5
- Rep Power
The previous DHCP server is our current PDC.
However on just having a thought... we have turned it off over our lunch period now to test the effects and the IP which releates to the server is still handing out requests.
This leads us to believe another pc/laptop whatever it may be must also have the IP.
28th June 2010, 01:10 PM #6
I'm afraid you will have to be methodical about this.
1 - try and find the MAC address of the originating box. This can help tie down possible location of the offending device ... especially if you record MAC addresses in your inventory. however, it may be spoofing the MAC address.
2 - Manually segment your network. Pull the plug on wireless first (in case something has your wireless key) and then slowly pull each link to your core switch. Have a machine directly attached to your core switch and renew DHCP every minute or so.
3 - Once you have identified the offending uplink to the core go to the switch stack connecting to that link. Have a look at which ports have a lot of traffic on them and then disable the ports, one by one. The other option is to do it by pulling network leads out if you cannot identify the port with *lots* of traffic on it.
Some network tools can help track this down but it really does depend on having them set up prior to an event in most cases.
By darrenmcginnis in forum Windows Server 2000/2003
Last Post: 30th November 2009, 12:25 PM
By rob101 in forum Windows Server 2000/2003
Last Post: 4th November 2009, 09:09 AM
By cromertech in forum Wireless Networks
Last Post: 30th September 2009, 12:38 PM
By AngryITGuy in forum Wireless Networks
Last Post: 23rd September 2008, 09:52 AM
By wesleyw in forum Windows
Last Post: 7th July 2006, 08:45 AM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)