Re: 3500XL - duplicate IP and Windows NT/2000 ser [7:73868]
Firesox wrote: Well, the thing is the MAC addrss appears to be moving around thruout the network. One time I see the mac stored in one switch, then onto another switch the next. Another time, the MAC address disappears from the network all together. Whatever this mac is, it's causing the duplicate IP on the network and bringing the applications down. Does this IP address belong to one of the servers? Is that why it brings down the applications?? Is there some sort of routing/addressing problem caused by a misconfigured attempt at load balancing so that sometimes the servers see each other directly and sometimes the packets flow through a router (picking up the router's MAC address?) What is this MAC address? Perhaps the vendor code will help you understand what's happening, as others mentioned. If it's a router manufacturer, that could mean something like what I described. I suspect there's more to this story and that some advanced, convoluted features related to load balancing, clustering, redundancy, VLANs, etc. have done what advanced, convoluted features tend to do: get mucked up. :-) Please tell us more if you can. Thanks. Priscilla Oppenheimer Pat Donlon wrote in message news:[EMAIL PROTECTED] Firesox wrote: I have a bunch of 3500XL switches thruout my customer's lan. They are having a problem with unknown mac keep appearing and disappearing from the network. I can trace the mac-address of the unknown station by show mac from the swtich CLI. What's strange is that it appears at one switch, but a minute later it appears in the different switch. what's even more strange is that all NT/2000 servers log shows there is an IP conflict with this mac address. Of course, the servers IP function stops due to this duplicate IP, but comes back in a few minutes. All the servers report the duplicate IP comes from the same mac address. Has anyone seen this problem? Thanks **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html I know that the NT team where I work had a batch of new HP netservers delivered last year with the built in NICs with all the same mac addresses. They had to perform a bios upgrade I think to fix the problem. You should probably try to find out where what port(s) the duplicate mac and IP appear. Cheers Pat **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=73929t=73868 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Re: 3500XL - duplicate IP and Windows NT/2000 ser [7:73868]
Oops, I read the post as if the MACs were duplicated. I have also come across a situtation where a faulty station (Wyse terminal actually) responded to all ARPs as if it owned the IP. I had an interesting conversation with Wyse support who remained convinced that it was impossible for their terminals to do that, since they weren't programmed that way. The fact that I had a packet capture of it happening didn't even phase them! I ended up tracing down the Wyse terminal via its MAC (it wasn't changing ports as described in the original post) and replaced it. Windows computers use ARPs to detect duplicate IPs. Perhaps something similar is happening? It could also be a Proxy ARP issue. Zsombor Papp wrote: There are duplicate IP addresses, not duplicate MACs. And all the duplicate IP addresses come from the same MAC address, as if a single machine had suddenly all the IP addresses configured on the same interface. I don't see how this can be attributed to a L2 loop. Firesox, what is this phantom MAC address? Thanks, Zsombor **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=73912t=73868 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Re: 3500XL - duplicate IP and Windows NT/2000 ser [7:73868]
There are duplicate IP addresses, not duplicate MACs. And all the duplicate IP addresses come from the same MAC address, as if a single machine had suddenly all the IP addresses configured on the same interface. I don't see how this can be attributed to a L2 loop. Firesox, what is this phantom MAC address? Thanks, Zsombor Tom Martin wrote: As far as the duplicate MACs go, it sounds like you have a layer-2 loop. Especially considering that all of your servers are experiencing the problem. When they ARP to verify that no other station has their IP, they see their own ARP and assume that another station is doing the same thing. Layer-2 Loops will also cause MACs to appear to be sourced from different switches in the network. Is STP enabled everywhere? Mismatched channelling will also cause the same behavior. Firesox wrote: I have a bunch of 3500XL switches thruout my customer's lan. They are having a problem with unknown mac keep appearing and disappearing from the network. I can trace the mac-address of the unknown station by show mac from the swtich CLI. What's strange is that it appears at one switch, but a minute later it appears in the different switch. what's even more strange is that all NT/2000 servers log shows there is an IP conflict with this mac address. Of course, the servers IP function stops due to this duplicate IP, but comes back in a few minutes. All the servers report the duplicate IP comes from the same mac address. Has anyone seen this problem? Thanks **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=73904t=73868 -- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
