| Event Id | 4198 |
| Source | Tcpip |
| Description | The system detected an address conflict for IP address %2 with the system having network hardware address %3. The local interface has been disabled. |
| Event Information | According to Microsoft : Cause : This event is logged when the system detected an address conflict for IP address with the system. Resolution : Assign a different static IP address If your IP address is statically assigned and does not originate from a DHCP server, change the IP address assigned to the network interface so that it does not duplicate another IP address on the network. To perform this procedure, you must have membership in Administrators , or you must have been delegated the appropriate authority. To change the static IP address:. 1.Click Control Panel , doubl-click Network and Sharing Center , and then click Manage network connections . 2. Right-click the network interface you want to update, and then click Properties. 3. Click Internet Protocol Version 4 (IPv4) , click Properties , and then type a different IP address in IP Address. Verify : To verify that an IP address is assigned: 1.At the DHCP-enabled client computer, click Start , click Run , and then type cmd . 2.Type ipconfig /all to view lease-status information. 3.The output of the ipconfig command should show an IPv4 or IPv6 address marked "preferred." ----------------------------------------------------------------------------------------------------------------------------Cause: Both the adapter and another device are using the specified address. Each device should have a unique address. Resolution 1: 1. Go to Network and Dial-up Connections in Control Panel. 2. Check the network adapter configuration. It should be configured according to the manufacturer?s specifications and should not conflict with the configurations of other hardware. Resolution 2. To resolve the problem, you must locate the duplicate MAC address and either replace the NIC or fix your LAA setting: 1. Log on to a working TCP/IP client. 2. Open a CMD prompt and type ping x.x.x.x. 3. Type ARP -a x.x.x.x. You should receive: Internet Address Physical Address x.x.x.x xx:xx:xx:xx:xx:xx <-- matches the event log entry 5. Type NBTSTAT -A x.x.x.x where -A is case sensitive. Media access control address = xx-xx-xx-xx-xx-xx 6. If you receive HOST NOT FOUND, the duplicate is NOT NetBIOS enabled, like a Jet Direct Printer, Router, Unix box, or Novell server. 7. After replacing the NIC or fixing LAA, restart. |
| Reference Links | How do I troubleshoot events 4198 and 4199? 12-Oct-01 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.