up vote 1 down vote favorite
share [g+] share [fb]

I have a weird issue that popped up on our network.

Once or twice a week a user (it's always a different user) would complain about not being able to communicate to our Small Business Server 2003 that handles Exchange, DNS and file sharing, essentially cutting the machine off from any sort of network communication.

When I check the ARP table on that particular server there is a static ARP entry mapped to the IP address of the workstation in question with a completely different MAC address. If I manually delete the static entry the machine is back online. The weird thing is that it's always a different machine that has this problem.

For the life of me I can't figure out what's setting these static ARP entries on the server and forcing me every time to go in and remove it manually to bring the workstation back online.

Our environment is fairly small (20 workstations and 2 servers).

Any help is appreciated.

link|improve this question
Does the MAC address correspond to anything on your network? The first half of the MAC addreass will id the vendor. – JS. Aug 28 '09 at 15:30
It's been driving me so crazy that I didn't even think of finding out what the MAC address could belong to. On the surface it seemed like it is a server issue as I don't know what could compel the server to add a random static ARP entry to its table for an MAC address to an IP address that it doesn't belong to. – Igor Aug 28 '09 at 15:40
feedback

2 Answers

up vote 4 down vote accepted

Try to identify if the MAC address belongs to any equipment on your network. You can lookup vendor addresses here.

Do you have a wireless access point on your network, is it secured? look for the MAC addresses of any connected devices. You can normally view these from the access point.

Do you have any virtual machines running on any of the workstations or servers?

Is it always the same MAC address that appears in the arp table?

What about the arp caches on your network switch and router ( if they let you view them) do the IP/MACs correspond with the table on your server at the time you have an issue? Does powercycling the switch/ router make any difference?

link|improve this answer
Great suggestions. I will be looking into trying to find a pattern in the mappings and hopefully will be able to tie it to a device on the network. – Igor Aug 29 '09 at 6:11
feedback
up vote 3 down vote

Is there any chance that someone is running ettercap or similar arp cache poisoning style attack on your network?

link|improve this answer
Anything is possible but like I mentioned, it's a fairly small network and it's just the sporadic workstation that's having the issue so it's highly unlikely, there is really nothing to be gained. – Igor Aug 29 '09 at 6:12
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.