rogue ip address and stp traffic

[ellsanto]

I have a couple of issues that may or may not be related, so I am posting them together.

1. Using wireshark, I have found that i have several pcs that attempt to locate an IP address that is within my subnet, but not one of my systems. All of my systems are assigned static IPs. Occasionally when I run command arp -a on my PDC, the IP address shows on my list of connected clients. However it is listed as not having a MAC address and the IP type is "invalid" as opposed to "dynamic" like the others.

2. I have noticed an lot (a request every two seconds) of STP traffic across my network. I realize this may be nothing to be concerned about, but the source is a MAC address that I cannot locate on my network. Strange. It is not slowing the network or effecting it negatively, but if anyone can give me some insight into why this has happened, that would be great.

I have a small Server 2000 network with mostly WIN 2000 clients and a few lucky XP users.

ellsanto
-Gillan lives, have you met him?

 

[longhair]

ellsanto,
any wireless access points?
regards,
longhair

 

[juniper911]

For Point 1
Are these PCs that are trying to get an IP address yours? Are they part of your system? They are just trying to obtain an IP address and because they sit on the same subnet as your own system that is why you are seeing the traffic as the PC's will be broadcasting.

For Point 2
Write down the MAC address and go to

http://www.coffer.com/mac_find,

enter the MAC address and that will tell you what vendor that device is from. This may help you in finding it.

 

[ellsanto]

Thanks for the replies. Here is what I found:

1. Quite a while back, a printer was set up with the "rogue" IP address. Turns out the printer was removed from the network, but the profile info was still in the registry. After deleting the key, I haven't seen any requests for that IP.

2. An unmanaged switch was the culprit.

Thanks again everyone for the replies.

ellsanto
-Gillan lives, have you met him?