| Event Id | 30001 |
| Source | ipnathlp |
| Description | The DHCP allocator was unable to check whether the IP address x.x.x.x is in use on the network for local IP address X.X.X.X. This error may indicate lack of support for address-resolution on the network, or an error condition on the local machine. The data is the error code. |
| Event Information | According to Microsoft: CAUSE: There is a host on the network which has a duplicate of an IP address in NATs DHCP pool of addresses. RESOLUTION: To resolve this issue, use either of the following methods: • Change the IP address on the offending host (that which already has the IP address). • Exclude the specific IP address from the DHCP allocator range in NAT. You can identify the host with the undesired duplicate IP address in one of the following ways: • On the NAT servers ARP cache, there may be a mapping of the IP address in conflict to the MAC address of the offending computer. The network administrator would then need to determine which specific computers had the given MAC address. To display the ARP cache on the NAT server, perform the arp -a command on the NAT server at a command prompt. • In some circumstances the DHCP client may display a message indicating the conflict and specifying the MAC address of the offending computer. • Temporarily remove the DHCP client from the network, and from a Microsoft machine on the network, perform the following command at a command prompt nbtstat -a x.x.x.x where x.x.x.x is the address in conflict. If the offending host on the network is running a Microsoft operating system, the above command should return a list of the NetBIOS names the remote host is listening on. This may assist you in further determining which specific computer has the address in conflict. |
| Reference Links | Windows 2000 NAT DHCP Allocator Service Logs |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.