Hi,
I have just inherited several Windows 2003 servers on a 192.168.0.x subnet.
Three of the servers (2 x Active Directory – 1 x Terminal Server) are broadcasting a lot of ARP packets 1-3 per second.
From TCPDUMP
10:15:23.721613 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:24.479278 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:24.643302 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:25.784233 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:26.542148 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:26.704924 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
10:15:27.847354 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32
Further inspection shows that the packets are coming from the mac address of the 3 servers. This has been confirmed physically by removing the network cable from the servers which stops the packets.
We have no computers on a 192.168.30.x subnet nor to my knowledge have we ever had any.
There is no reference to 192.168.30.32 in the DNS or in any ARP tables.
If I change my PC address to 192.168.30.31 – I can’t ping 192.168.30.32.
If I change my address to 192.168.30.32 – I get an IP address conflict. (Event viewer on my PC shows that it’s conflicting with the MAC of all three servers.) Though none of the servers detect an IP conflict.
All three servers have the same hardware (which is different to our other Windows servers)
Mainboard: Intel SE7525GP2 FRU V0.01
Onboard NIC: Intel(R) PRO/1000 MT
We also have a linux box on the same hardware but it’s not sending these ARP packets.
Any ideas??
