Results 1 to 13 of 13
  1. #1
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts

    IP address assigned to phantom device

    I recently changed the internal IP addresses of 3 Windows 2008 servers. Now one of the old IP addresses (10.10.15.21) is refusing to be assigned to a new computer (no problems with the other 2 which were .25 and .26).

    Windows 7 claims that the IP address is in use by a device on the network (even though the server originally using that IP had no problem using it for a number of years). The event log entry says there is conflict for IP address 0.0.0.0 on the hardware address 00-00-00-00-00-00 which is not very helpful at all.

    I have tried ping scans of the network which show that the IP address in question is not responding and the address does not show up in arp tables. I am now at my wits end and looking for advice on what to do next.

    Cheers,
    Brett

  2. Subscribe to our Windows Secrets Newsletter - It's Free!

    Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

    Excel 2013: The Missing Manual

    + Get this BONUS — free!

    Get the most of Excel! Learn about new features, basics of creating a new spreadsheet and using the infamous Ribbon in the first chapter of Excel 2013: The Missing Manual - Subscribe and download Chapter 1 for free!

  3. #2
    Lounge VIP
    Join Date
    Apr 2011
    Location
    Scotland
    Posts
    1,168
    Thanks
    44
    Thanked 134 Times in 115 Posts
    Hello Brett, welcome to the lounge.

    A few possibilities:

    If the address is not in an ARP table, it should not exist on your network - or more specifically I don't think it could be routed to, so even if it did exist, nothing could conflict with it. That being the case, the issue is on the problem host.

    Are you using DHCP? Does ipconfig /renew make a difference?

    Are you using static? If so, can you re-assign a different IP address to the host, or is it just the .21 that has the problem? Is the .21 address blocked on other hosts?

    Was the former .21 address a statically assigned address on the server? Could the DNS cache in the problem host be the problem? Try a DNS flush.

    It's odd that the event log reports those IP and MAC addresses, but from what I recall 0.0.0.0 means "unknown IP address". Perhaps a ipconfig /all may reveal a little about what that host thinks is going on?

  4. #3
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    We don't use DHCP for our servers or desktops, they all have static IPs. DHCP for laptops assigns addresses from .171. The .21 was previously statically assigned to a server, I have tried ipconfig /displaydns which does not show .21 at all and ipconfig /flushdns which makes no difference.

    No host that I have tried so far appears to be able to reuse .21 but can reuse .25 and .26 which were also statically assigned to servers previously. Pinging .21 gives "Destination host unreachable" which to me indicates that nothing on the network is actually using that IP address.

  5. #4
    Lounge VIP
    Join Date
    Apr 2011
    Location
    Scotland
    Posts
    1,168
    Thanks
    44
    Thanked 134 Times in 115 Posts
    Hmmm....no host can be assigned the .21 address - rather odd. Have you changed your subnetting with the swap around of the servers' IP addresses? Could .21 be outside your address range?

    "Destination unreachable" suggests that the router knows about the address but can't find a route (it isn't in the ARP table). Just a thought: does tracert show anything unusual?

  6. #5
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    No subnetting was changed, only the static IP addresses were altered. I can use other IP addresses around .21, just not .21 itself. Tracert also reports destination host unreachable.

  7. #6
    Lounge VIP
    Join Date
    Apr 2011
    Location
    Scotland
    Posts
    1,168
    Thanks
    44
    Thanked 134 Times in 115 Posts
    Sorry Brett, the only other thing I could suggest is to start re-booting routers etc in case there is a problem with RIP and/or "stuck" ARP tables......but to be honest that's clutching at straws.

    Wonder if anyone else has some thoughts?

  8. The Following User Says Thank You to Tinto Tech For This Useful Post:

    BrettR (2011-12-12)

  9. #7
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    I found the .21 entry in the arp tables of the two switches on the network. I'll reboot those tonight (as clearing the arp table doesn't seem to drop the IP) and check how it goes tomorrow. Thanks for your help.

  10. #8
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Finally got this sorted after rebooting routers and switches had made no difference at all. Somehow the server was remembering its old IP address and not allowing any other computer to use it. I shut down the server, assigned the IP to the new host and restarted the server. Now everything is as it should be.

  11. #9
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Spoke too soon, unfortunately. 30 minutes after the server restarting the new host gets an IP conflict and goes off the network. Luckily I go on leave today and will only have to worry about this next year.

  12. #10
    Lounge VIP
    Join Date
    Apr 2011
    Location
    Scotland
    Posts
    1,168
    Thanks
    44
    Thanked 134 Times in 115 Posts
    Very odd. What is the server role? How many network interfaces? Any directly attached devices that could require an IP address?

    Does ipconfig /all reveal anything unusual on the server?

  13. #11
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    The server (Windows 2008) has the File Server and Application Server roles assigned. ipconfig, arp and netstat show nothing odd, the .21 address does not appear at all and does not exist in the registry either.

    There are two network interfaces on the computer with the second being disabled. That one was set to use DHCP so I reset it with a fixed IP just in case.

    I've been through all the administrative tools, nothing uses the rogue address.

  14. #12
    Lounge VIP
    Join Date
    Apr 2011
    Location
    Scotland
    Posts
    1,168
    Thanks
    44
    Thanked 134 Times in 115 Posts
    ....a long short perhaps, but could one of your network applications hosted on that server be configured to communicate through a TCP/IP port on 10.10.15.21 rather than 127.0.0.1?

    TCP View might show if an application is trying to use the address on the server.

  15. #13
    New Lounger
    Join Date
    Dec 2009
    Location
    Cape Town, South Africa
    Posts
    11
    Thanks
    1
    Thanked 0 Times in 0 Posts
    TCP View also does not show the .21 address as being in use.

    When I get back from leave I will start uninstalling the very few applications that have been installed and also removing server roles until I hopefully kill whatever is holding on to that address.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •