Folks

I've got a weird one! A virtual server has been assigned a fixed IP address
of 10.186.27.31 - but it has an IP address conflict with another server.
However, I've checked all the virtual servers in the network and there is not
another server with that IP address.

Ping responses are typically haphazard as shown below:


Reply from 10.186.27.31: bytes=32 time<1ms TTL=128
Reply from 10.186.27.31: bytes=32 time<1ms TTL=128
Reply from 10.186.27.31: bytes=32 time<1ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2047ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2594ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2638ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2683ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2729ms TTL=128
Request timed out.
Reply from 10.186.27.31: bytes=32 time=2774ms TTL=128
Reply from 10.186.27.31: bytes=32 time<1ms TTL=128
Reply from 10.186.27.31: bytes=32 time<1ms TTL=128
Reply from 10.186.27.31: bytes=32 time<1ms TTL=128

Now, the server that I ran the pings from is a physical DNS server, so it
knows about most of the boxes on the network. This arp list shows the
offending IP address:

C:\>arp -a

Interface: 10.186.27.17 --- 0xa
Internet Address Physical Address Type
10.186.27.9 00-00-5e-00-01-3c dynamic
10.186.27.12 00-30-48-8a-c4-50 dynamic
10.186.27.13 00-30-48-60-73-fc dynamic
10.186.27.23 00-03-ff-40-73-fc dynamic
10.186.27.24 00-03-ff-5f-73-fc dynamic
10.186.27.26 00-03-ff-8f-c4-50 dynamic
10.186.27.28 00-03-ff-83-c4-50 dynamic
10.186.27.31 00-03-ff-88-c4-50 dynamic
10.186.27.32 00-03-ff-8b-c4-50 dynamic
10.186.27.40 00-03-ff-4b-73-fc dynamic
10.186.27.42 00-03-ff-bd-c4-50 dynamic
10.186.27.46 00-03-ff-df-c4-ce dynamic
10.186.27.100 00-30-48-8a-c4-50 dynamic

10.186.27.31 is represented by 00-03-ff-88-c4-50 which is a Virtual Server
MAC address, rather than a physical card, so I know that it's coming from a
Virtual Guest. But I have disconnected every single Virtual Guest's NIC from
it's host network and I still get ping responses!

I deleted the reverse DNS entry for that IP address, in the hope that the
offending machine would register its hostname, but so far no joy! :-(

C:\>nslookup 10.186.27.31
Server: ewcp07.ew.local
Address: 10.186.27.17

*** ewcp07.ew.local can't find 10.186.27.31: Non-existent domain

C:\>

The platform is Windows Server 2003 SP2 with Virtual Server 2005 R2. How do
I troubleshoot this? I'm in real trouble here!

H