Microsoft KB Archive/174929

= No Response to ARP Causes Duplicate IP Addresses on Network =

Article ID: 174929

Article Last Modified on 9/22/2005

-

APPLIES TO


 * Microsoft Windows NT Server 4.0, Terminal Server Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows for Workgroups 3.11
 * Microsoft TCP/IP for Windows for Workgroups 3.11
 * Microsoft TCP/IP for Windows for Workgroups 3.11a
 * Microsoft TCP/IP for Windows for Workgroups 3.11b
 * Microsoft Windows 95

-



This article was previously published under Q174929



SYMPTOMS
You may experience one of the following error messages, depending on the client:

Windows NT 4.0
System Process - System Error

The system has detected an IP address conflict with another system on the network. The local interface has been disabled. More details are available in the system event log. Consult your network administrator to resolve the conflict.

Windows 95
Windows

The system has detected a conflict for IP address a.b.c.d with the system having hardware address 11:11:11:11:11:11. The interface has been disabled.

Windows for Workgroups
Windows

The system has detected a conflict for IP address a.b.c.d with the system having hardware address 00:00:00:00:00:00. The local interface has been disabled.



CAUSE
The Microsoft networking clients listed above do not respond to an address resolution protocol (ARP) request when the ARP sender's IP address is 0.0.0.0. This causes a problem with Dynamic Host Configuration Protocol (DHCP) environments, which may result in duplicate IP addresses on the network.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack



STATUS
Microsoft has confirmed that this is a problem in Windows NT 4.0 and Windows NT Server 4.0, Terminal Server Edition. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4. Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION
Non-Microsoft DHCP clients fill in the sender's IP address with 0.0.0.0 when using ARP to check if the DHCP lease that it has been offered is a duplicate address on the network. Because the Microsoft clients above do not respond to this ARP, it is possible to end up with duplicate addresses on the network.

The following information is taken from RFC1541:

The client may issue an ARP request for the suggested request. When broadcasting an ARP request for the suggested address, the client must fill in its own hardware address as the sender's hardware address, and 0 as the sender's IP address, to avoid confusing ARP caches in other hosts on the same subnet. If the network address appears to be in use, the client sends a DHCPDECLINE message to the server and waits for another DHCPOFFER. As the client does not have a valid network address, the client must broadcast the DHCPDECLINE message.

Keywords: kbbug kbfix kbqfe kbnetwork kbwinnt400sp4fix win95 kbhotfixserver KB174929

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.