IP Conflict Message

Dear Sir,

We have a LAN of around 100 Desktop Windows Client and some Linux , Unix , Windows Servers . Yesterday all of sudden we got message of their respective  IP getting Conflict at all our Computers . We tried to identify the problem but could not find anything . But surprisingly after 15 minutes the problem got over itself and no IP conflict message was there .

Sir , kindly guide me about the cause of this problem . Is it due to some Virus or any thing else . Also pl guide me that in future how to protect  against such problems .

Rgds
B Mittal
bvmittalAsked:
Who is Participating?
 
The--CaptainCommented:
Duplicate IP warnings are generated when a client is bringing up an IP interface and first sends an ARP request for it's own IP to make sure it's not already in use...

Without knowing more about the problem, my two best guesses are:

1. Rogue or haywire DHCP server passing out leases for IPs that are already assigned.

2. Someone (idiotic and/or malicious user) or something (malware of some kind) attempting to implement an ARP spoof attack, which might cause a single machine to answer *all* ARP requests on the local subnet...

Given that the problem disappeared quickly, I'm leaning towards #2 (probably an idiotic/malicious user, since malware doesn't tend to give up so easily).

If I'm right, the solution is to fire the moron who thinks it's OK to screw with your network.

Cheers,
-Jon
0
 
r_naren22atyahooCommented:
How many Workstations had this problem????
0
 
mcsa_2003Commented:
Hi,
Its look like your network have conflict with anther network same class same subnet
Do you have VLAN?
And did you check what the error msg in event viewer?
Also check from DHCP if you have it, who have conflict with who?
I don’t thing so this is virus unless new virus around

regards
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
mattacukCommented:
What subnet range are you currently useing?
0
 
OkigireCommented:
Other reasons I've seen (rare) that aren't rogue/issues are:
 - A buggy DHCP server assigning an IP more than once... either because it's buggy, or it doesn't manage the lease properly.
 - I've also had people diagnose their own problems by temporarily assigning themself a static IP in a dynamic environment... another problem.
 - If a computer goes switches network connections and/or into/out of standby/hibernate, sometimes it keeps its own IP and it won't work... some users are good and go to hit REPAIR (release/renew) which fixed the conflict

I've used the "net send" command to alert conflicts before to find out what's going on.
0
 
The--CaptainCommented:
>- A buggy DHCP server assigning an IP more than once... either because it's buggy, or it doesn't manage the lease properly

When duplicating advice previously posted, it is polite to say "As The--Captain says" or maybe "I agree with The--Captain".

>- I've also had people diagnose their own problems by temporarily assigning themself a static IP in a dynamic
>environment... another problem.

Not the case here, unless some idiot is assigning every IP in the entire subnet to themselves by hand (an impossible task in 15 minutes).

>- If a computer goes switches network connections and/or into/out of standby/hibernate, sometimes it keeps its own IP and
>it won't work... some users are good and go to hit REPAIR (release/renew) which fixed the conflict

Also not the case here, since this would annoy a few machines at best, not every machine on the segment.

>I've used the "net send" command to alert conflicts before to find out what's going on

Yikes!  You haven't disabled that service yet?!?!  

Cheers,
-Jon
0
 
OkigireCommented:
Jon/TheCaptain - thanks for your reply!  What you say is true, but was something slightly different than what I was getting at.  A buggy DHCP server does not have to be a rogue server, which is the difference I was after.  I did miss "ALL COMPUTERS" so you're correct in saying that a manually-assigned IP is not the case here.  The net send service is useful in certain private-network situations.  I don't think there is anything wrong with either of our replies, except for the one piece of information I missed, and thanks for pointing that out!  :)
0
 
The--CaptainCommented:
I object - Okigire has merely (if unwittingly) duplicated my advice.  He says:

>A buggy DHCP server does not have to be a rogue server, which is the difference I was after

"Rogue" may not imply "buggy", but "haywire" certainly does, and I used both terms.

Cheers,
-Jon
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.