2

One of our Windows 2003 R2 ISA firewall servers recently had a 1-hour spell of intermittent connectivity to our Internet WAN connection, which was fixed after disabling then re-enabling the network adapter. The error log showed multiple instances of the following error:

Event 4199:
The system detected an address conflict for IP address 192.0.2.123 
with the system having network hardware address 00:00:00:00:00:00. 
Network operations on this system may be disrupted as a result

As far as I know, a null MAC address is impossible. I only found one Google result for the same error with the same strangely empty MAC address, an experts-exchange question with no answer.

The problem has not recurred, but I'm nervous having a server with unexplained issues still running as part of our live network. Without knowing the cause, I have no way of knowing that it might not happen again.

Is this a driver failure? Hardware failure? Network stack issue? Could there have been some strange conflict where something somehow tried to take over our WAN address?

ryandenki
  • 357
  • 7
  • 19
  • 5
    Use the RFC3330-allocated 192.0.2.0/24 for example IP addresses. – womble Aug 04 '11 at 05:23
  • depends on what is connected to your server, maybe some switch/router sending a spurious src mac. If there is a duplicate IP then check ARPs there maybe GRAT ARPs being transmitted too, because of the duplicate IP –  Aug 04 '11 at 04:37
  • 1
    Just to be *really* picky, 00:00:00:00:00:00 is not *null*, it's just all 0's. Null would be a very serious issue. – Mark Henderson Aug 17 '11 at 01:59
  • @Mark Henderson Yes, that is a bit picky. But having a conflict with a MAC address that doesn't exist is a fairly serious issue on its own. – ryandenki Aug 19 '11 at 02:30
  • I have this same problem with IPv6 (IPv4 is just fine same machine) and it only occurred after I renamed the server. The server has been rebooted a couple of times since then, same problem. Very odd. Only TCPIP 4199 for a symptom. It has Teaming NICs though, 6 NICs to a single virtual adapter. – Mark Allen Sep 27 '11 at 19:08

1 Answers1

1

It's not "impossible" - clearly it happened (for some values of "happen"). If you were able to fix it via disabling and re-enabling the network adapter in software, then my guess is that there was a low level driver software fault. It would be probably really really hard to recreate this and take it to the vendor and say 'fix this' so unfortunately you are probably going to have to chalk it up to the gremlins.

Aaron
  • 2,968
  • 1
  • 23
  • 36
  • 1
    It certainly sounds like some sort of driver issue, although I'm very hesitant to write things off as "one of those things", although I don't see much else you can do about this one. – Mark Henderson Aug 17 '11 at 02:00
  • We definitely haven't written it off as "one of those things". We've added event log monitors to alert staff if it ever happens again, and accelerating a project to replace it with a newer package. – ryandenki Aug 19 '11 at 02:32