Windows Forum

Ask something
Discussion Locked

Event ID 4319 on 2K Server

0 helpful
9 replies

by glord

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My event viewer on the server is filled up with this one error, event id 4319. The description reads: A duplicate name has been detected on the TCP network. Ths IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
First of all, I don't know what I am looking at when I run nbtstat -n. What does this mean and how do I fix it?

9 replies

by cg it

what it means is somewhere on the network LAN someone configured a computer with an IP address that another computer already has, hense a conflict.

Nbstat displays protocol connections the -n switch lists the local NetBIOS names.

To find the offending computer use ARP -a which will display the ARP table of IP to MAC addresses

by glord

Poster rated this answer.
The output from ARP -a lists the ip addresses and related MAC addresses on three seperate Interfaces. I have 3 NICs on this server. I don't know how to interpret this. On one interface is listed an address 192.9.200.5, while this is also listed on the other two interfaces (NICs). Is this the conflict?

by cg it

::shaking head::: In any Local Area Network [not subnets], there can be NO, repeat NO! duplicate IP addresses in the range used for for that LAN, Period. Else you'll get the message you got.

Analogy: Think of a network interface card [NIC] as your mailbox outside your house. It has an address which the mailman uses to deliver your mail. It's unique to your house on your street. So as in a computer network. Convention is 1 to 1. 1 NIC, 1 computer. Post Office is the same. One house, one mailbox. For the sake of debate, You can have 2 but that would just mess up the mailman and you won't get your mail. Most people would rather get their mail. Same on the network, you CAN have 2 of the same address but then you won't get anything to work. Most rather it worked. Since you pointed out after running the ARP -a that you have 3 NICs 2 of which have the same IP address there's a conflict. Doesn't matter if they are on the same box or not. So you get your Oppps damnit message. To get rid of the opps damnit message change the IP address on one of the 2 NICs that have the same address. Then take a self study basic course on TCP/IP networking .

by glord

Let me explain better. I have three, uniquely indentified NICs on my Windows 2000 server, each connected to a series of switches. The results from ARP -a, display these NICs as Interface: 192.9.200.200,192.9.200.201,192.9.200.202. Beneath each of these aare three columns: Internet Address, Physical Address, and Type. Beneath Internet address are various IP addresses for other uniquely id'd devices connected to the switches. At this point some of these devices are listed on all three of the 3 Interfaces listed above. For example, a PC with the IP address of 192.9.200.5, appears beneath each Interface. There are others. Does this signify the aforementioned conflict? If so what steps are required to remove this conflict. Thanks for your help, sorry for my previous vagueness.

by duwaned

Hi.

This may be a long shot, but I have seen similar problems with multi-homed (more than 1 NIC) machines where the switches/hubs they are connected to try to be smart and cache machine details. In other words, what happens is the switch/hub caches the servers IP and Name, then every time the machine restarts it querys the network for machines with the same name or IP. The switch/hub responds saying that there is already a machine with that name on the network (as it is a different MAC address (because of being multi-homed). The only way I have been able to get around this is to log into the management interface of the switch/hub and clear it's cache each time I restart the server.

Give it a go and let me know if it helps.

Regards.
Duwane

This discussion is closed to new replies.