Knowledge Base

No Response to ARP Causes Duplicate IP Addresses on Network

Article ID: 174929

Article Last Modified on 9/22/2005

APPLIES TO

Microsoft Windows NT Server 4.0, Terminal Server Edition
Microsoft Windows NT Workstation 4.0 Developer Edition
Microsoft Windows NT Server 4.0 Standard Edition
Microsoft Windows for Workgroups 3.11
Microsoft TCP/IP for Windows for Workgroups 3.11
Microsoft TCP/IP for Windows for Workgroups 3.11a
Microsoft TCP/IP for Windows for Workgroups 3.11b
Microsoft Windows 95

This article was previously published under Q174929

SYMPTOMS

You may experience one of the following error messages, depending on the client:

Windows NT 4.0

System Process - System Error
The system has detected an IP address conflict with another system on the network. The local interface has been disabled. More details are available in the system event log. Consult your network administrator to resolve the conflict.

Windows 95

Windows
The system has detected a conflict for IP address a.b.c.d with the system having hardware address 11:11:11:11:11:11. The interface has been disabled.

Windows for Workgroups

Windows
The system has detected a conflict for IP address a.b.c.d with the system having hardware address 00:00:00:00:00:00. The local interface has been disabled.

CAUSE

The Microsoft networking clients listed above do not respond to an address resolution protocol (ARP) request when the ARP sender's IP address is 0.0.0.0. This causes a problem with Dynamic Host Configuration Protocol (DHCP) environments, which may result in duplicate IP addresses on the network.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

STATUS

Microsoft has confirmed that this is a problem in Windows NT 4.0 and Windows NT Server 4.0, Terminal Server Edition. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4. Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION

Non-Microsoft DHCP clients fill in the sender's IP address with 0.0.0.0 when using ARP to check if the DHCP lease that it has been offered is a duplicate address on the network. Because the Microsoft clients above do not respond to this ARP, it is possible to end up with duplicate addresses on the network.

The following information is taken from RFC1541:

The client may issue an ARP request for the suggested request. When broadcasting an ARP request for the suggested address, the client must fill in its own hardware address as the sender's hardware address, and 0 as the sender's IP address, to avoid confusing ARP caches in other hosts on the same subnet. If the network address appears to be in use, the client sends a DHCPDECLINE message to the server and waits for another DHCPOFFER. As the client does not have a valid network address, the client must broadcast the DHCPDECLINE message.

Keywords: kbbug kbfix kbqfe kbnetwork kbwinnt400sp4fix win95 kbhotfixserver KB174929

Microsoft KB Archive/174929

Contents