Starting yesterday morning, computers on our campus admin network began getting "The system has detected a conflict for IP address xx.xx.196.xx with the system having hardware address 00:06:6E:36:8B:35." error messages. The mac address is always the same for all computers. Gradually the problem spread through out the day. I have been unable to trace that mac address to anything on campus. Thinking it was bogus and it might be the DHCP server malfunctioning, it was physically removed from the network. The problem persists. Any suggestions would be appreciated, particularily if anyone knows how to trace back a mac address. Thanks, Jay Krob Director of Information Systems Kansas Wesleyan University

Can you tell us a little bit about your network infrastructure on campus? You could try using a packet sniffer or Network Monitor to get some info about where the problem is coming from...

Starting from the outside world in: We have a T1 from sprint which enters the campus via a cisco 2600 router. From there via ethernet to a blackbox switch which is the center of a star topolgy network of fiber from all the campus buildings. Each building is connected to the fiber via ether an 3com FMS II hub (as many as 4 stacked)with a transciever or a media converter and and a 3com 1100 switch with hubs on their own ports. The primary email/web/dhcp server is a NT4.0 running Exchange 5.5 for email. The dorms are isolated on their own network of the same basic structure and are not experiencing the problem (xx.xx.197.xx) A colleague from another college is sending me some sniffer software so hopefully that can help. Is that helpful? Thanks, JK

Thanks for the detailed info. Im a little rusty with NT 4.0, but isn't there a log file or something that keeps track of all DHCP leases? You could look for the MAC address in there. I'm assuming you use DHCP reservations, and the client machines always end up with the same address. If so, then you could pinpoint the rogue machine.