If this is a domain environment, wouldn't this message appear on all PDC and BDC servers, or those running SNMP?
to find the MAC address, what about typing "arp -a" from a command prompt to see the server's arp table? Bill Creighton CCNP Network Design Engineer, eVPN AT&T Business Service Delivery NSPM > -----Original Message----- > From: Reimer, Fred [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 12, 2003 11:08 AM > To: [EMAIL PROTECTED] > Subject: RE: 3500XL - duplicate IP and Windows NT/2000 server > [7:73868] > > > Huh? You're confusing even me now ;-) > > "All NT servers say the same thing with same exact mac addrss" > > ??? > > So you have all of your NT servers configured for the same IP address? > Follow me here. If your NT servers had }different{ IP > addresses, then a > mis-configured PC that was a duplicate would only duplicate > }one{ of those > servers. You wouldn't see the same MAC address on all of > your servers if > your servers had different IP addresses, unless there was a > virus out on > your network that caused random PC's to answer with a bogus > MAC address the > ARPs of all of your servers (multiple IP addresses). > > Why don't you do a packet capture on a server and see what it > is receiving? > I bet there is data in the payload that says something like > "I 0wn y0ur > n3tw0rk"... > > What happens to be this MAC address that is floating around? > > Fred Reimer - CCNA > > > Eclipsys Corporation, 200 Ashford Center North, Atlanta, GA 30338 > Phone: 404-847-5177 Cell: 770-490-3071 Pager: 888-260-2050 > > > NOTICE; This email contains confidential or proprietary > information which > may be legally privileged. It is intended only for the named > recipient(s). > If an addressing or transmission error has misdirected the > email, please > notify the author by replying to this message. If you are not > the named > recipient, you are not authorized to use, disclose, > distribute, copy, print > or rely on this email, and should immediately delete it from > your computer. > > > -----Original Message----- > From: Firesox [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 12, 2003 8:50 AM > To: [EMAIL PROTECTED] > Subject: Re: 3500XL - duplicate IP and Windows NT/2000 server > [7:73868] > > The log on NT says > > Duplicate IP found with the mac address xx.xx.xx.xx.xx.xx > > All NT servers say the same thing with same exact mac addrss, > but I cannot > find the mac address at all. > > The log on the switches show nothing interesting. > > > > Thanks > > wrote in message > news:[EMAIL PROTECTED] > > Searching CCO, connot find a thing. Do you have logging > enabled, if yes > what > > do the switches say? Try a protocol sniffer(receive span a > problem server > > port), sometimes it is nice to see ip handle things. And > learn a lot... > > > > What did the NT system log say? > > > > Tried newer IOS? (long shot....) > > > > Martijn > > > > -----Oorspronkelijk bericht----- > > Van: Firesox [mailto:[EMAIL PROTECTED] > > Verzonden: maandag 11 augustus 2003 14:19 > > Aan: [EMAIL PROTECTED] > > Onderwerp: 3500XL - duplicate IP and Windows NT/2000 server > [7:73868] > > > > > > I have a bunch of 3500XL switches thruout my customer's lan. > > They are having a problem with unknown mac keep appearing > and disappearing > > from the network. > > > > I can trace the mac-address of the unknown station by "show > mac" from the > > swtich CLI. > > What's strange is that it appears at one switch, but a > minute later it > > appears in the different switch. > > > > what's even more strange is that all NT/2000 servers log > shows there is an > > IP conflict with this mac address. > > Of course, the servers IP function stops due to this > duplicate IP, but > comes > > back in a few minutes. > > All the servers report the duplicate IP comes from the same > mac address. > > > > Has anyone seen this problem? > > > > Thanks > > **Please support GroupStudy by purchasing from the GroupStudy Store: > > http://shop.groupstudy.com > > FAQ, list archives, and subscription info: > > http://www.groupstudy.com/list/cisco.html > > **Please support GroupStudy by purchasing from the GroupStudy Store: > > http://shop.groupstudy.com > > FAQ, list archives, and subscription info: > http://www.groupstudy.com/list/cisco.html > **Please support GroupStudy by purchasing from the GroupStudy Store: > http://shop.groupstudy.com > FAQ, list archives, and subscription info: > http://www.groupstudy.com/list/cisco.html > **Please support GroupStudy by purchasing from the GroupStudy Store: > http://shop.groupstudy.com > FAQ, list archives, and subscription info: > http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73935&t=73868 -------------------------------------------------- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
