I had myself a right little job yesterday.
A client was not able to do anything on the network. They had a valid IP that was assigned by the Server 2003 DHCP.
The machine would work for a while, then mysteriously drop off the network, though the ARP cache was populated. If i cleared the ARP table, then everything would work for another while.
My first thought was duplicate IP. So i logged into a few other machines and servers, pinged the appropriate IP and checked the ARP cache for the MAC address. All of them showed the MAC Address of the machine that was affected.
So i tried to remove and reinstall the network card drivers. No difference
I then tried using a USB NIC, a Linksys U200M, but this caused Blue Screens.
I moved it to a different network point, with a different cable, same issue. I moved it to a physically separate network, issue did not reoccur
For shits and giggles i assigned an IP to it in the DHCP server that was not it’s current IP.
one ipconfig /renew later and i could still ping the old IP and see a different MAC address on it. Some gimp had manually assigned some device with the same IP the machine i was working with was getting from DHCP
The real pain here was that Windows should have detected this and attempted to correct it.
I’ve yet to find the device, but when i do, it’s owner will have it inserted into their smallest most of orifices!
