Solved

Static IP Conflict - Need to release a static IP I cannot see or ping on the network

Posted on 2006-07-02
36
412 Views
Last Modified: 2011-09-20
My computer (running windows XP with the latest updates) has always had the IP of 10.0.0.5. I restarted the computer tonight and when I tried to login to the domain I was told that another computer on the network had taken my IP address. This has never happened before. I have tried a repair, I have looked at the arp tables, I have reset my switches, I have rebooted my router, I have done everything I can think of to release the 10.0.0.5 address but have been unsuccessful. I have also tried to switch another computer on my network to 10.0.0.5 but each computer says that the static IP has been taken. My question is, what does windows XP look at when finding an IP is already in use, (as it definitely does not just PING for that IP) and how can I release that IP when I can't even ping it?

Some facts:
DHCP is run by a linksys router but has a minimum IP of 10.0.0.100 so this should not effect the 10.0.0.5 IP
When I try to ping 10.0.0.5 I get 'host is unreachable'
Using the IP of 10.0.0.6 I am able to login to the domain and access the internet

**** I need to get the 10.0.0.5 IP back as I have all other computers on the network sending their snmp traps to this IP so just switching to another IP is NOT an option ****

I need this working ASAP!!  Thanks!
0
Comment
Question by:dotcomexec
  • 16
  • 11
  • 4
  • +3
36 Comments
 
LVL 48

Expert Comment

by:Jay_Jay70
Comment Utility
check your lmhosts file and make sure there is no references in it to that IP
0
 
LVL 32

Expert Comment

by:rsivanandan
Comment Utility
Login with 10.0.0.6 for now and then try to ping 10.0.0.5, see if you get a response. If not, go to the DHCP server and see who has taken that IP, isn't that possible with linksys router ? If so, you can just take it back and have the other machine reboot (Once you find it).


Once it is fixed, make sure you add a reservation for this address so that you don't have to have this problem in future.

Cheers,
Rajesh
0
 

Author Comment

by:dotcomexec
Comment Utility
The lmhosts file has only this line:
127.0.0.1 localhost
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
Go to your command prompt and run nbtstat -a 10.0.0.5  this will give you the name and mac address of the computer causing the problem, your ping reslt scould be due to a firewall blocking ping.

nbtstat results

C:\Documents and Settings\user>nbtstat -a 192.168.1.104

Local Area Connection:
Node IpAddress: [0.0.0.0] Scope Id: []

    Host not found.

Wireless Network Connection:
Node IpAddress: [192.168.1.104] Scope Id: []

           NetBIOS Remote Machine Name Table

       Name               Type         Status
    ---------------------------------------------
    **********         <00>  UNIQUE      Registered
    **********         <20>  UNIQUE      Registered
    WORKGROUP      <00>  GROUP       Registered
    WORKGROUP      <1E>  GROUP       Registered
    WORKGROUP      <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered

    MAC Address = XX-XX-XX-XX-XX-XX

Look at type 20 for the computer name

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
I have tried pinging 10.0.0.5 from my servers as well as other computers on the network as well as my computer (when i'm using 10.0.0.6) and none of them can find the 10.0.0.5 (we are all on the same subnet).

As I said in my original post my router assigns IPs from 10.0.0.100 and up so that does not afffect my computer. I did check the dhcp listing on my router and it did not show 10.0.0.5.
0
 

Author Comment

by:dotcomexec
Comment Utility
C:\>nbtstat -a 10.0.0.5

Local Area Connection 3:
Node IpAddress: [10.0.0.6] Scope Id: []

    Host not found.
0
 

Author Comment

by:dotcomexec
Comment Utility
My domain is hosted on a RHEL box using samba.
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
Check my network places.  If you see local area network 2, then you may have gotten a second NIC replacing the first (windows has done this in the past).  The problem is the origional NIC (which may not be visable in my network places) still has the 10.0.0.5 IP so the second NIC (the one windows replaced the first one with) can not use it.

If you do see local area network 2 then reboot into safe mode and uninstall all NICs form device manager (make sure you have drivers for your NIC first).  Reboot into normal mode and reinstall the NIC.

eb
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
C:\>nbtstat -a 10.0.0.5

Local Area Connection 3:
Node IpAddress: [10.0.0.6] Scope Id: []

    Host not found.

This means if the host is out there it is running a firewall that is blocking nslookup... unfortunatly that does not help us any.

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
I only have one connection in my network places: Location Area Connection 3
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
OK if you have local area connection 3 that means that there were others that have been removed, so one of the ones that is not there any more may have the IP.

Go into safe mode and remove any network cards you see in device manager.  Reboot into normal mode and reinstall the NIC, re assign the IP and you are good to go.

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
Anybody else have any ideas?
0
 

Author Comment

by:dotcomexec
Comment Utility
Okay I'll try that ebjers
0
 

Author Comment

by:dotcomexec
Comment Utility
Uninstalled and reinstalled the network card. Still cannot use 10.0.0.5. I'm up to Local Area Connection 4 now. Any other ideas?
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
did you uninstall from safe mode?

If your NIC is not onboard, uninstall in normal mode, reboot into safe mode and remove all NICs again.  Power down and remove the NIC from your system.
Power on once with out the NIC installed.  Power down and reinstall the NIC.  Boot up again and reinstall drivers.

If you only removed the NIC in normal mode it may still be there, I have uninstalled a NIC in normal mode and then seen 3 or more of the same card in device manager in safe mode.

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
I uninstalled in normal mode. I'll go uninstall in safe mode.
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
Uninstall in safe mode is best, also booting once with out the physical card in the system can be a great help.

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
I uninstalled in safe mode, rebooted w/o the card, rebooted again with the card with no change.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
Did you check device manager in safe mode, make sure no network card are listed?

Also try these as a last resort;

1) Disable all external access to your network (unplug the internet connection) if this resolves the problem you have a hacker
2) Check every pc on the network by running ipconfig /all from the command prompt
3) Unplug computers one at a time till the problem goes away (last one unpluged is the problem)
4) If you have a managed switch mirror all traffic to a port and hook up a packet sniffer, watch your traffice for the IP

After that I'm out of ideas.

good luck
eb

0
 

Author Comment

by:dotcomexec
Comment Utility
I disabled the internet connection, no change.

I have a program called OpenManage IT Assistant which searches the network for every machine and shows me information about every machine, I am confident every machine is listed and none of them have an IP of 10.0.0.5.

Thanks for the effort ebjers!

If anybody has any more ideas the 500 points are still up for grabs.
0
 

Author Comment

by:dotcomexec
Comment Utility
I had a small break-through. If I disable the Local area connection, then set the IP to 10.0.0.5 then enable the connection I am able to use 10.0.0.5 yet when I restart my computer I still get a static IP conflict... does that give anybody any ideas?
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
You still have a 'shadow' NIC on your system that is using that IP...  unfortunatly it is not showing up in safe mode, so I'm not sure how you can remove it.

time to sleep now, so no more from me.  Good luck

eb
0
 
LVL 32

Expert Comment

by:rsivanandan
Comment Utility
Did you try my first comment, I mean checking in the router ?

Cheers,
Rajesh
0
 

Author Comment

by:dotcomexec
Comment Utility
Yea I did check the router rajesh, no sign of the 10.0.0.5 IP.

Eb - I don't think its my NIC as I shut off my computer and tried to setup the static IP on another computer on my network and got the same error saying there was an IP conflict.
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
OK then try my "last resort ideas" may be a lot of work, but may be the only way to find the problem system.

this time I mean it, last comment going to sleep...

eb
0
 
LVL 32

Expert Comment

by:rsivanandan
Comment Utility
Ok, lets talk about your network. How many machines do you have? any network printers etc ?

Cheers,
Rajesh
0
 

Author Comment

by:dotcomexec
Comment Utility
Yea I've been saying that for the past 2 hours... "Last thing I'm going to try then I'm leaving..."

Anyway, I may unplug every comp from the switch then see what happens, just not tonight. The really weird thing is that I can change the static IP to 10.0.0.5... disable then enable the connection and I'm on the domain using the 10.0.0.5 with no problems.

So does anybody know exactly how and where XP finds out if an IP is conflicting with another IP on the network? Again, I'm using all Windows XP machines with the domain running from samba on a RHEL4 machine.

Thanks!
0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
www.ethereal.com. Download the free analyser; lets see if we can see traffic anywhere for .5

Not sure of the topology of your network in regards to switches/routers etc. Break your network into logical chunks and disconnect segment A. Reboot your work station with .5 set as its static again. Still get the message?. If yes, plug segment A back in; unplug segment B. reboot your work station again; still get the error? Repeat through the network.

Anyone brought in a PDA/handheld, appliance or new bit of equipment lately?

0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
Can't comment on your linux box as it is I won't use the thing however, I believe it has the equivalent of tcpdump which allows you to monitor traffic arriving or leaving on the server's interface(s); does this see traffic from 10.0.0.5 in the monitoring tool?

At the very least, it should see traffic coming from YOUR pc with its static setting when it boots up and tries to broadcast.
0
 
LVL 23

Accepted Solution

by:
Erik Bjers earned 500 total points
Comment Utility
Not sure how Windows checks the IP...

Any changes to your server, to your network before the problem started?

The fact that you have local area connection 3 (now 4) indicates that your system has had more than one network card in the past, or has had the NIC replaced.  This combined with the fact that you can disable the card, assign the IP, and reenable the card so things works; indicates that the problem is a 'shadow' NIC on your system trying to use the IP.  However the fact that you can shut the server down and the problem follows you to another computer says the problem is on your network... strange.

I think this could be caused by a faulty switch, if the switch is not clearing it's ARP table it may think there is a system with that IP out there even if there isen't.  If you have a spare switch try replacing the one you have.

You can also try uninstalling all network services from Windows (use the Windows CD to add remove components).  BACK THINGS UP FIRST
Then reinstall the network services.

The only way to find the problem I can think of is to physicaly disconnect systems untill the problem goes away.

eb
0
 

Author Comment

by:dotcomexec
Comment Utility
I'm going to give this one to ebjers as he was extremely helpful and actually did lead me to figuring out a way around the IP conflict. Its the end all answer (unfortunately) but it'll work for now.
0
 

Author Comment

by:dotcomexec
Comment Utility
*Its NOT the end all answer... (my last comment excluded the not which made the comment rather confusing)
0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
What was the solution?
0
 
LVL 13

Expert Comment

by:prashsax
Comment Utility
Ok dotcomexec, I will answer you question as to how windows xp find out if the IP is already assigned.

If does it by looking at the MAC address.

As you know IP addresses works on layer 3. When Windows send an ARP request for any IP a MAC address is resolved to this IP address.

So, when you machines send ARP request for IP 10.0.0.5 it find a MAC address different from your own machine and it will tell you that IP 10.0.0.5 is already been assigned on the network.

Here is how you can find out the IP address.
Make your machines IP 10.0.0.6.

Now try and ping 10.0.0.5.(I know it won't reply)

Now use this command:
arp -a

It will show you the mac address of machine having IP 10.0.0.5.

Now if you have manageable switch, you can try and locate the MAC address from the MAC table of the switch.

You must be wondering why you can't ping the IP 10.0.0.5, but still windows says it exist.
This is due to the fact Software firewall blocks on IP traffic(i.e ICMP, UDP, TCP).
And they do not block layer 2 ehthernet frames. This is how windows find out the IP conflict.
0
 
LVL 23

Expert Comment

by:Erik Bjers
Comment Utility
Thanks for the points, what was the ultimate solution...

eb
0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
I give up :)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

The Need In an Active Directory enviroment, the PDC emulator provide time synchronization for the domain. This is important since Active Directory uses Kerberos for authentication.  By default, if the time difference between systems is off by more …
Resolve DNS query failed errors for Exchange
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

5 Experts available now in Live!

Get 1:1 Help Now