IP Address Conflict (from a machine not on LAN)

[Itsme]

We are running into this weird issue. There is this one MAC address
00:0E:9B:xxxxxx. Once in a while many machines on our LAN will have an
IP conflict with this same MAC address. In other words, when I checked
the event logs, all the machines with IP Address conflict will have
conflict with this MAC address.

It will last for a moment and then the conflict goes away on its own. I
looked up the IANA database and this MAC belongs to "PRIVATE". This is
according to http://standards.ieee.org.

I have a case opened with Microsoft PSS and they have ran a lot of tests
on various machines on our LAN (netdiag, dcdiag etc.) Everything so far
looks OK to them. We also have checked DHCP server or any possibility of
a rogue DHCP server, but that's not that case here. Our LAN is a flat
subnet of default class C.

In my understanding there is some system on the internet which is trying
to take over our IP addresses or something. I might be wrong, but I have
a database of MACs within my LAN and this MAC does not belong to our
LAN. Any help in solving this mystery would really be appreciated.

 

[Itsme]

Does anyone know a way of blocking a MAC address at the router (Cisco
2501)/ firewall (WatchGuard FB-III) level?

Thanks.

 

[Phillip Windell]

What about a virtual "adapter"? Like an OS running from in Virtual PC or
similar thing? also VPN Adapters are "virtual" and not physical, there is
one created for each dial-up connection if I remember properly. I don't know
if these are the problem,...I'm just tossing a few ideas out there.

You could reserve a particular IP# and assign it to that MAC in your DHCP,
then next time it comes along it might get the IP you designated and then
you might be able to track it down with that when it shows up. If this
causes the unknown device to fail, then the sudden failure of a device you
never knew you had would identify it as the culprit.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


We are running into this weird issue. There is this one MAC address
00:0E:9B:xxxxxx. Once in a while many machines on our LAN will have an IP
conflict with this same MAC address. In other words, when I checked the
event logs, all the machines with IP Address conflict will have conflict
with this MAC address.

It will last for a moment and then the conflict goes away on its own. I
looked up the IANA database and this MAC belongs to "PRIVATE". This is
according to http://standards.ieee.org.
I have a case opened with Microsoft PSS and they have ran a lot of tests on
various machines on our LAN (netdiag, dcdiag etc.) Everything so far looks
OK to them. We also have checked DHCP server or any possibility of a rogue
DHCP server, but that's not that case here. Our LAN is a flat subnet of
default class C.
In my understanding there is some system on the internet which is trying to
take over our IP addresses or something. I might be wrong, but I have a
database of MACs within my LAN and this MAC does not belong to our LAN. Any
help in solving this mystery would really be appreciated.

 

[Itsme]

Wonderfull, Phillip. I am going to do this right now. I will let you know how it
goes.

Virtual Adapter - I am not sure someone on my LAN would have it, but you can
never be too sure about your users. Can I contact you over email ?