Huh? You're confusing even me now ;-)
"All NT servers say the same thing with same exact mac addrss"
???
So you have all of your NT servers configured for the same IP address?
Follow me here. If your NT servers had }different{ IP addresses, then a
mis-configured PC that was a duplicate would only duplicate }one{ of those
servers. You wouldn't see the same MAC address on all of your servers if
your servers had different IP addresses, unless there was a virus out on
your network that caused random PC's to answer with a bogus MAC address the
ARPs of all of your servers (multiple IP addresses).
Why don't you do a packet capture on a server and see what it is receiving?
I bet there is data in the payload that says something like "I 0wn y0ur
n3tw0rk"...
What happens to be this MAC address that is floating around?
Fred Reimer - CCNA
Eclipsys Corporation, 200 Ashford Center North, Atlanta, GA 30338
Phone: 404-847-5177 Cell: 770-490-3071 Pager: 888-260-2050
NOTICE; This email contains confidential or proprietary information which
may be legally privileged. It is intended only for the named recipient(s).
If an addressing or transmission error has misdirected the email, please
notify the author by replying to this message. If you are not the named
recipient, you are not authorized to use, disclose, distribute, copy, print
or rely on this email, and should immediately delete it from your computer.
-----Original Message-----
From: Firesox [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 12, 2003 8:50 AM
To: [EMAIL PROTECTED]
Subject: Re: 3500XL - duplicate IP and Windows NT/2000 server [7:73868]
The log on NT says
Duplicate IP found with the mac address xx.xx.xx.xx.xx.xx
All NT servers say the same thing with same exact mac addrss, but I cannot
find the mac address at all.
The log on the switches show nothing interesting.
Thanks
wrote in message
news:[EMAIL PROTECTED]
> Searching CCO, connot find a thing. Do you have logging enabled, if yes
what
> do the switches say? Try a protocol sniffer(receive span a problem server
> port), sometimes it is nice to see ip handle things. And learn a lot...
>
> What did the NT system log say?
>
> Tried newer IOS? (long shot....)
>
> Martijn
>
> -----Oorspronkelijk bericht-----
> Van: Firesox [mailto:[EMAIL PROTECTED]
> Verzonden: maandag 11 augustus 2003 14:19
> Aan: [EMAIL PROTECTED]
> Onderwerp: 3500XL - duplicate IP and Windows NT/2000 server [7:73868]
>
>
> I have a bunch of 3500XL switches thruout my customer's lan.
> They are having a problem with unknown mac keep appearing and disappearing
> from the network.
>
> I can trace the mac-address of the unknown station by "show mac" from the
> swtich CLI.
> What's strange is that it appears at one switch, but a minute later it
> appears in the different switch.
>
> what's even more strange is that all NT/2000 servers log shows there is an
> IP conflict with this mac address.
> Of course, the servers IP function stops due to this duplicate IP, but
comes
> back in a few minutes.
> All the servers report the duplicate IP comes from the same mac address.
>
> Has anyone seen this problem?
>
> Thanks
> **Please support GroupStudy by purchasing from the GroupStudy Store:
> http://shop.groupstudy.com
> FAQ, list archives, and subscription info:
> http://www.groupstudy.com/list/cisco.html
> **Please support GroupStudy by purchasing from the GroupStudy Store:
> http://shop.groupstudy.com
> FAQ, list archives, and subscription info:
http://www.groupstudy.com/list/cisco.html
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info:
http://www.groupstudy.com/list/cisco.html
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=73924&t=73868
--------------------------------------------------
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
