IP address assigned to phantom device

**BrettR** · 2011-12-09 00:21

I recently changed the internal IP addresses of 3 Windows 2008 servers. Now one of the old IP addresses (10.10.15.21) is refusing to be assigned to a new computer (no problems with the other 2 which were .25 and .26).

Windows 7 claims that the IP address is in use by a device on the network (even though the server originally using that IP had no problem using it for a number of years). The event log entry says there is conflict for IP address 0.0.0.0 on the hardware address 00-00-00-00-00-00 which is not very helpful at all.

I have tried ping scans of the network which show that the IP address in question is not responding and the address does not show up in arp tables. I am now at my wits end and looking for advice on what to do next.

Cheers,
Brett

**Tinto Tech** · 2011-12-10 15:41

Hello Brett, welcome to the lounge.

A few possibilities:

If the address is not in an ARP table, it should not exist on your network - or more specifically I don't think it could be routed to, so even if it did exist, nothing could conflict with it. That being the case, the issue is on the problem host.

Are you using DHCP? Does ipconfig /renew make a difference?

Are you using static? If so, can you re-assign a different IP address to the host, or is it just the .21 that has the problem? Is the .21 address blocked on other hosts?

Was the former .21 address a statically assigned address on the server? Could the DNS cache in the problem host be the problem? Try a DNS flush.

It's odd that the event log reports those IP and MAC addresses, but from what I recall 0.0.0.0 means "unknown IP address". Perhaps a ipconfig /all may reveal a little about what that host thinks is going on?

**BrettR** · 2011-12-12 00:09

We don't use DHCP for our servers or desktops, they all have static IPs. DHCP for laptops assigns addresses from .171. The .21 was previously statically assigned to a server, I have tried ipconfig /displaydns which does not show .21 at all and ipconfig /flushdns which makes no difference.

No host that I have tried so far appears to be able to reuse .21 but can reuse .25 and .26 which were also statically assigned to servers previously. Pinging .21 gives "Destination host unreachable" which to me indicates that nothing on the network is actually using that IP address.

**Tinto Tech** · 2011-12-12 03:05

Hmmm....no host can be assigned the .21 address - rather odd. Have you changed your subnetting with the swap around of the servers' IP addresses? Could .21 be outside your address range?

"Destination unreachable" suggests that the router knows about the address but can't find a route (it isn't in the ARP table). Just a thought: does tracert show anything unusual?

**BrettR** · 2011-12-12 03:31

No subnetting was changed, only the static IP addresses were altered. I can use other IP addresses around .21, just not .21 itself. Tracert also reports destination host unreachable.

**Tinto Tech** · 2011-12-12 03:42

Sorry Brett, the only other thing I could suggest is to start re-booting routers etc in case there is a problem with RIP and/or "stuck" ARP tables......but to be honest that's clutching at straws.

Wonder if anyone else has some thoughts?

**BrettR** · 2011-12-12 03:57

I found the .21 entry in the arp tables of the two switches on the network. I'll reboot those tonight (as clearing the arp table doesn't seem to drop the IP) and check how it goes tomorrow. Thanks for your help.

**BrettR** · 2011-12-14 22:46

Finally got this sorted after rebooting routers and switches had made no difference at all. Somehow the server was remembering its old IP address and not allowing any other computer to use it. I shut down the server, assigned the IP to the new host and restarted the server. Now everything is as it should be.

**BrettR** · 2011-12-15 00:27

Spoke too soon, unfortunately. 30 minutes after the server restarting the new host gets an IP conflict and goes off the network. Luckily I go on leave today and will only have to worry about this next year.

**Tinto Tech** · 2011-12-15 01:47

Very odd. What is the server role? How many network interfaces? Any directly attached devices that could require an IP address?

Does ipconfig /all reveal anything unusual on the server?

**BrettR** · 2011-12-15 03:16

The server (Windows 2008) has the File Server and Application Server roles assigned. ipconfig, arp and netstat show nothing odd, the .21 address does not appear at all and does not exist in the registry either.

There are two network interfaces on the computer with the second being disabled. That one was set to use DHCP so I reset it with a fixed IP just in case.

I've been through all the administrative tools, nothing uses the rogue address.

**Tinto Tech** · 2011-12-15 03:38

....a long short perhaps, but could one of your network applications hosted on that server be configured to communicate through a TCP/IP port on 10.10.15.21 rather than 127.0.0.1?

TCP View might show if an application is trying to use the address on the server.

**BrettR** · 2011-12-15 05:51

TCP View also does not show the .21 address as being in use.

When I get back from leave I will start uninstalling the very few applications that have been installed and also removing server roles until I hopefully kill whatever is holding on to that address.

Thread: IP address assigned to phantom device

Thread Tools