IP conflict

[bdoub1eu]

This morning, our CFO had been logged for roughly 45 minutes when he received an error popup message:

System Error : There is an IP address conflict with another system on the network

I checked his event logs and saw this error:

The system detected an address conflict for IP address 10.3.100.117 with the system having network hardware address 00:0D:56:4E:62:1F. Network operations on this system may be disrupted as a result.

I checked the DHCP server and saw that the MAC address above on the other computer (Computer 2) was another one of our users that had just booted up her machine. Both are dynamic IP's...The IP pool for users is .100 to .255...

I can't seem to come up with an explanation...DHCP appears to be working fine and this is the first time I have seen this...

Could it be that it was merely coincidence that one IP lease was up (computer 1) and the other computer (Computer 2) was trying to obtain it? I checked the other computer that tried to get the .117 ip and saw this error in the event log:

Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 000D564E621F. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

Any ideas?

Thanks in advance for your help!

 

[bdoub1eu]

Sorry left out some info...Both workstations are XP and this is a Win2K network...

After the second machine tried to obtain the ip of the first, it ended up acquiring another ip...

 

[AlexIT]

Had it been a while since the other machine was booted? (Could it have used .117 then been shut down until past the expire time?)

Alex

 

[bdoub1eu]

Hi AlexIT!

It appears from the event log that both machines IP's expired overnight...And when they came in the following morning, they both acquired a new one...The CFO's machine acquired the new IP around 7:45am...The second machine came online around 8:20 and may have had the .117 address the day before because I did see some errors in that event log about not being able to use the .117 because it was already in use...So to answer your question, the second machine may have had the .117, then was shut down and during that time before bringing the machine back online the following morning, the lease expired on that IP.

Does that help? I don't think it ever kicked the first person off...It just gave him an error message about an IP conflict...Is it possible that the second computer (since it had the .117) the previous day came online and on the network before it could render a new IP thus causing the conflict?

Thanks in advance!

 

[AlexIT]

That is my theory, the CFO machine took the .117 IP the other machine was using before the lease expired, the second machine booted up with LAN properties of .117 and caused a moment of conflict before it (tried to) renew its lease on .117...so it grabbed the next open IP and everyone's happy.

Alex

 

[bdoub1eu]

Is there any way to avoid the error popups? The explanation makes sense, but how do we avoid it in the future? I've only seen this one time and the explanation that we've come up with seems logical but if that were the case, I feel I would see it more often (Computers shutting down, lease's expiring and renewing). It's not supposed to happen with DHCP is it? If that is what caused it, I'm just surprised I haven't seen more of these problems...

 

[AlexIT]

In most cases the computers will renew to the same IP address. But if you have all the machines off, and the leases expire, and you install a new machine (reformat, change the AD domain account, etc.) it will grab the IP another computer was using. Then you have a machine that gets "bumped."

It happens more than never, but very seldom...

Alex

 

[bdoub1eu]

AlexIT, why wouldn't it just grab a "new, available" IP rather than try to grab one that is already in use?

 

[AlexIT]

During the boot it should realize the lease is expired and send a broadcast packet to the DHCP source to renew, where it gets instructed that the IP address is used and then starts the release/renew cycle to get a new IP address. My guess is that this first packet is sent as the old IP address...are you on a switched network or using hubs?

Alex

 

[bdoub1eu]

The machine that tried to take the .117 IP is in a different dept that is on a Cisco 2900 Switch...

 

[AlexIT]

Check your switch configuration, my 3Com has the ability to direct broadcast packets to a specific port where the DHCP server resides. This setting did not configure itself automatically, though I thought it should.

Alex