Posted by: Roger Crawford
Ok Monday we get a call from one of our big customers and their network was going up and down and I had thought I had fixed this problem on Monday. Really didn’t find the problem I thought it was one of the Internal Web Servers had freaked out and had things rebooted and things was working when I left but little did I know. Well Tuesday morning we get the call they are acting up again so I head over there along with one of the Network guys meeting me there. We thought the ISA 2006 Server had a NIC or something going bad on it but I thought it was something else.
So we get on-site and are digging and poking around and not seeing a darn thing that would be effecting them. The network guy started to watch the ARP Table on the main core switch and started to see a entry for the IP of the ISA Server changing from one MAC address to another. OK this is weird and we could not find anything to what that one pointed at for a device. So he set the switch to hard code the MAC for the ISA IP and things calmed down. We looked some more and didn’t find anything else. But from the result of the network we had some things to clean up with users which we went around doing. We get tot he last one and this is a mobile user with a laptop. I get to looking on the laptop and notice that the NIC has sharing turned on, jackpot we found the device that was conflicting with the ISA Server as one of the NIC’s had the same IP of the server. So we will be moving the servers to a new IP Range. It was funny when I found this the user goes what when I was showing it to the network guy. I asked do you want me to lie to you or tell you the truth. They picked the truth and I told them that they was the one taking down the whole network. Boy was there face red but problem solved. The reason I thought I had it fixed the day before the user had packed up and left.
Til Later just Roger