I have a weird issue that popped up on our network.

Once or twice a week a user (it's always a different user) would complain about not being able to communicate to our Small Business Server 2003 that handles Exchange, DNS and file sharing, essentially cutting the machine off from any sort of network communication.

When I check the ARP table on that particular server there is a static ARP entry mapped to the IP address of the workstation in question with a completely different MAC address. If I manually delete the static entry the machine is back online. The weird thing is that it's always a different machine that has this problem.

For the life of me I can't figure out what's setting these static ARP entries on the server and forcing me every time to go in and remove it manually to bring the workstation back online.

Our environment is fairly small (20 workstations and 2 servers).

Any help is appreciated.

  • Does the MAC address correspond to anything on your network? The first half of the MAC addreass will id the vendor. – JS. Aug 28 '09 at 15:30
  • It's been driving me so crazy that I didn't even think of finding out what the MAC address could belong to. On the surface it seemed like it is a server issue as I don't know what could compel the server to add a random static ARP entry to its table for an MAC address to an IP address that it doesn't belong to. – Igor Aug 28 '09 at 15:40

Try to identify if the MAC address belongs to any equipment on your network. You can lookup vendor addresses here.

Do you have a wireless access point on your network, is it secured? look for the MAC addresses of any connected devices. You can normally view these from the access point.

Do you have any virtual machines running on any of the workstations or servers?

Is it always the same MAC address that appears in the arp table?

What about the arp caches on your network switch and router ( if they let you view them) do the IP/MACs correspond with the table on your server at the time you have an issue? Does powercycling the switch/ router make any difference?

  • Great suggestions. I will be looking into trying to find a pattern in the mappings and hopefully will be able to tie it to a device on the network. – Igor Aug 29 '09 at 6:11

Is there any chance that someone is running ettercap or similar arp cache poisoning style attack on your network?

  • Anything is possible but like I mentioned, it's a fairly small network and it's just the sporadic workstation that's having the issue so it's highly unlikely, there is really nothing to be gained. – Igor Aug 29 '09 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.