IP Conflict

[sippo]

If I'm getting an IP conflict on the our PDC, which has a static address, are we in trouble? The dhcp is in a completely different scope. So there is no hell in ways chance dhcp could pick up the same address.

 

The only way of getting it is someone giving a pc a static address. Do you think someones playing/hacking?!

 

[ozzy]

is the ip address of the server in the same range as default ip addresses of stuff from d-link or netgear ect(192.168.0.0), have someone plugged a wireless access point or the likes into your network.

just a thought:rolleyes:

[danrhodes]

Hi,

 

I don't think that you have anything to worry about, IP conflicts can be common issues if you do not keep accurate records of your static IP addresses.

 

Usually these issues are caused by such things as an old printer being plugged into the network that was previously using that static IP.

 

Another issues I have come accross before is Network Photocopiers, have you had your Resources Photosopier Support team out lately, if so they will have probably added it to the network for your Resources Technician to be able to print over the network, and being such helpfull guys they don's always ask for a reserved IP and just pick one that they think can't possible be used, and its always the case that because its a low range they use that its 9 / 10 times a PDC or SDC?

 

Try using Tracert to resolve the Hostname of the devices so that you can track down what the other device is, a neat little tool for this would be Agilent Network analyzer Standard Edition, you have to register for it but its free and its very good.

 

Let me know if you don't get this issue sorted soon and Ill dig out some more ideas for you to try.

 

Dan

[Brpilot99]

Hi ... The easiest way to sort this out is to down the server and run an IP scanner from a workstation. Hopefully it will pickup the IP that is the same as the server and with luck give you a pc name/number ..

 

Good Luck

 

Brian

Projector Lamps

Save money by changing the bulb only.

[mullet_man]

Yep just double check wireless's etc, but would suspect a teacher has been doing some home networking and messed about the IP settings on the laptop or something.

 

Look for the teacher who suddenly can't access the internet/sims etc, and has no idea why.

[sippo]

Thanks for the info guys. We have actually had photocopier people in but I gave them an IP. It all seems ok now, I'm going to restart the PDC at break to make sure.

[sippo]

WTF?!!

 

'We're sorry...

... but your query looks similar to automated requests from a computer virus or spy ware application. To protect our users, we can't process your request right now.

 

We'll restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected, you might want to run a virus checker or spy ware remover to make sure that your systems are free of viruses and other spurious software.

 

If you're continually receiving this error, you may be able to resolve the problem by deleting your Google cookie and revisiting Google. For browser-specific instructions, please consult your browser's online support centre.

 

We apologise for the inconvenience and hope we'll see you again on Google'

 

I can't see any viruses anywhere!!

[sippo]

Phew panic over!!

[sippo]

Still having this issue but on three servers. Its not dhcp as the scope is different for client PC's. Ran IP scanner cannot find the addresses with the same IP.

 

It only occurs for about 5 to 10 minutes then it goes. But in that time we have users moaning. It only happens once every 3 weeks or so.

 

Someone playing silly beggars?

[FN-GM]

WTF?!!

 

'We're sorry...

... but your query looks similar to automated requests from a computer virus or spy ware application. To protect our users, we can't process your request right now.

 

We'll restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected, you might want to run a virus checker or spy ware remover to make sure that your systems are free of viruses and other spurious software.

 

If you're continually receiving this error, you may be able to resolve the problem by deleting your Google cookie and revisiting Google. For browser-specific instructions, please consult your browser's online support centre.

 

We apologise for the inconvenience and hope we'll see you again on Google'

 

I can't see any viruses anywhere!!

 

Who said that?

[Michael]

Who said that?

 

I believe that's a Google message if Google believe too many requests are coming from the same IP.

 

@sippo - If for example you are using a class C network - 192.168.x.x it would be a very bad idea to set your servers with more commonly used IPs, (such as 192.168.1.1) as you're pretty much guaranteed any access point or router will by default use the first available address.

 

The fact it happens every three weeks; it would appear to be something someone is switching on. Unless you happen to have workstations not used for three weeks at a time? Possible but unlikely. I would say it is a router, access point or a machine someone is bringing into school.

[PiqueABoo]

IP address conflicts create TCPIP 4199 events in the event log and those contain the MAC address of the offending device (you can lookup the first few octets in the OUI to find the manufacturer).

 

May or may not help you find the device, but this is *the* place to start.

[funkymunky]

Once you have the MAC address then if you've got managed switches just ask them which port it is on and trace it that way. There's a few ways to get the MAC, either check the event log as it in the post above or do an arping - if you are using Windows a program called Hardping will do it although I think it's only a 30 day trial for free, if you're using *nix it will usually be installed by default. There's probably an arping binary about somewhere for Win.

[PiqueABoo]

Event log is easier, but eek! Do people really manage to sell these things? If you want a free util there's the brilliant "arpscan" attached to a post in the download forum

 

[Wrote that something like 8-9 years ago - update it every year or so with new vendor assignments]

[funkymunky]

Madness ain't it It's simple to write, or alternatively just use Linux...... I couldn't use Windows in my job, I'd go mental! (and be firing cygwin up every few minutes).

[sippo]

I believe that's a Google message if Google believe too many requests are coming from the same IP.

 

@sippo - If for example you are using a class C network - 192.168.x.x it would be a very bad idea to set your servers with more commonly used IPs, (such as 192.168.1.1) as you're pretty much guaranteed any access point or router will by default use the first available address.

 

The fact it happens every three weeks; it would appear to be something someone is switching on. Unless you happen to have workstations not used for three weeks at a time? Possible but unlikely. I would say it is a router, access point or a machine someone is bringing into school.

 

We have a 10.* network.

 

See thats what I'm thinking that someone is bringing in a laptop of some kind...

[PiqueABoo]

I couldn't use Windows in my job, I'd go mental!

 

I can and there's nothing I want to do these days I can't do from Windows, but on reflection it's taken truckloads of effort over the years to get the 'toolbox' together and keep it maintained... and I can't think of much in there that you'll find with Google even assuming you have the patience to wade through all those crummy software sites stuffed full of mostly mediocre [share|trial]ware that show up when you look for anything.

 

So yup, you're right.