Why is my server showing up as an Android device?

[Disaster]

Hi peeps!

 

Weird one happening here;

 

I have a server (2003) which homes our room booking software (on IIS) that has been having problems recently. I have had reports that the room bookings weren't available so I checked the server which informed my I had an IP conflict. This is odd as the server has an allocated IP address which is reserved in DHCP (server 2008 r2).

 

I decided to try and figure out what was going on and noticed the following:

 

doing an nslookup if IP I get the servername the first time but the next time I get an Android-randomnumbers.domain.internal - these alternate every time I do an nslookup.

Server IP address is reserved but MAC address was "5" so updated that to the proper MAC address.

In DHCP address leases the server is showing up as Reservation(inactive).

The MAC address of Android-randomnumbers.domain.internal is also the MAC address of the Room booking server.

 

Any ideas?

 

Appreciated!

 

p.s. posted here as a couple of platforms involved

[Roberto]

The most likely explanation is that someone's connecting to your wireless network and spoofing the ip address, and possibly MAC address too, of your server.

[Disaster]

Cheers for the response. I've checked our wireless management and nothing is showing up with that IP or MAC...

[machin05]

You could exclude the IP address from your DHCP scope and set the server IP address manually (static).