How to Troubleshoot Duplicate MAC Address Conflicts

Last reviewed: December 31, 1997
Article ID: Q164903
The information in this article applies to:
  • Microsoft Windows NT Workstation versions 3.5, 3.51, and 4.0
  • Microsoft Windows NT Server versions 3.5, 3.51, and 4.0

SUMMARY

If Windows NT detects a duplicate media access control address on the network, you will receive one of the following messages in the Windows NT System Event Log:

   Event ID   : 4198
   Source     : TCP/IP
   Description: The system detected an address conflict for IP address
                129.0.0.1 with the system having hardware address
                02:A0:8C:DE:00:FD the local interface is being disabled.

   -or-

   Event ID   : 4199
   Source     : TCP/IP
   Description: The system detected an address conflict for IP address
                0.0.0.0 with the system having network hardware address
                xx:xx:xx:xx:xx:xx. Network operations on this system may
                be disrupted as a result.

NOTE: IP addresses and addresses will be different than the sample.

All network connectivity over TCP/IP to this computer will cease until the conflict is resolved and the system is restarted.

MORE INFORMATION

Media access control addresses are preassigned and permanently burned into the network interface card (NIC). These addresses under normal circumstances are always unique, however, rare errors made during the manufacturing process can cause duplicate media access control addresses to be used and cause this problem. Another source of duplicate media access control addresses can occur if you are assigning locally administered media access control addresses (LAA), in which case you are overriding the burned- in address in favor of the locally assigned media access control address. Some Windows NT drivers allow for LAA media access control addresses, usually Token Ring adapter drivers.

How to Troubleshoot

To troubleshoot this problem, you have to determine which other computer on the network is using the same media access control address. Several tools that ship with the Microsoft TCP/IP stack can be used to locate the duplicate addressed computer.

To isolate the duplicate media access control address, perform the following steps:

From a working TPC/IP based client:

  1. Ping the TCP/IP address found in the event log entry from a command prompt by typing the following:

          PING  129.0.0.1
    

    You should get replies back similar to these from the duplicate addressed computer:

          Pinging 129.0.0.1 with 32 bytes of data:
    

          Reply from 129.0.0.1: bytes=32 time=10ms ttl=128
          Reply from 129.0.0.1: bytes=32 time=<10ms ttl=128
          Reply from 129.0.0.1: bytes=32 time=<10ms ttl=128
          Reply from 129.0.0.1: bytes=32 time=<10ms ttl=128
    

  2. To verify the computer’s media access control address is the duplicate, type the following at a command prompt:

          ARP -a 129.0.0.1
    

    You should get a reply back as follows:

          Internet Address  Physical Address
          129.0.0.1 02:A0:8C:DE:00:FD  <-- matches the event log entry
    

  3. We can now use NBTSTAT to get the NetBIOS (friendly) name of the duplicate computer by typing the following at a command prompt:

          NBTSTAT -A 129.0.0.1
    

    You should get a reply back with the NetBIOS name of the computer. Use this NetBIOS name to determine who the owner of the computer is so you can locate it on your network.

       NAME             TYPE               STATUS
       -----------------------------------------------
       NTSERVER1           <00>                Unique
       DOMAN-NAME          <00>                GROUP
       NTSERVER1           <03>                Unique
    
       Media access control address = 02-A0-8C-DE-00-FD
    
       If you get a message:
    
          HOST NOT FOUND.
    
       This would indicate that the duplicate computer is not a NetBIOS
       enabled computer, like a Novell server, Unix server, Router, or perhaps
       a Jet Direct Printer.
    
    

  4. Once you find the duplicate addressed computer, you can either replace its network card, or if a locally administered media access control address (LAA), change it to be unique on the network.

Changing a LAA can be accomplished by performing the following steps:

  1. Click the Start button, point to Settings, click Control Panel, and then double-click the Network icon.

  2. While displaying the properties of the installed network adapter, change the properties or configuration of the installed Network Adapters LAA to use a unique LAA.
Keywords          : kbdomain nthowto NTSrvWkst kbnetwork
Version           : WinNT:4.0
Platform          : winnt
Issue type        : kbhowto


================================================================================


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: December 31, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.