JSI Tip 4213. How do I troubleshoot events 4198 and 4199?

Jerold Schulman

October 11, 2001

1 Min Read
ITPro Today logo in a gray background | ITPro Today


When the O/S detects a duplicate media access control (MAC) address, all network connectivity over TCP/IP to your computer will stop until the conflict is resolved and the computer is restarted. The System event log will contain one of the following:

   Event ID   : 4198   Source     : TCP/IP   Description: The system detected an address conflict for IP address                x.x.x.x with the system having hardware address                xx:xx:xx:xx:xx:xx the local interface is being disabled.    Event ID   : 4199   Source     : TCP/IP   Description: The system detected an address conflict for IP address                x.x.x.x with the system having network hardware address                xx:xx:xx:xx:xx:xx. Network operations on this system may                be disrupted as a result.

This is either a rare manufacturing mistake or you made a mistake while using LAA.

To resolve the problem, you must locate the duplicate MAC address and either replace the NIC or fix your LAA setting:

1. Log on to a working TCP/IP client.

2. Open a CMD prompt and type ping x.x.x.x. You should get a response from the duplicate computer like:

      Pinging x.x.x.x with 32 bytes of data:      Reply from x.x.x.x: bytes=32 time=10ms ttl=128      Reply from x.x.x.x: bytes=32 time=<10ms ttl=128      Reply from x.x.x.x: bytes=32 time=<10ms ttl=128      Reply from x.x.x.x: bytes=32 time=<10ms ttl=128

4. Type ARP -a x.x.x.x. You should receive:

      Internet Address  Physical Address      x.x.x.x xx:xx:xx:xx:xx:xx  <-- matches the event log entry

5. Type NBTSTAT -A x.x.x.x where -A is case sensitive. The reply should indicate the NetBIOS name of the duplicate computer:

   NAME             TYPE               STATUS   -----------------------------------------------   NTSERVER1           <00>                Unique   DOMAN-NAME          <00>                GROUP   NTSERVER1           <03>                Unique   Media access control address = xx-xx-xx-xx-xx-xx

6. If you receive HOST NOT FOUND, the duplicate is NOT NetBIOS enabled, like a Jet Direct Printer, Router, Unix box, or Novell server.

7. After replacing the NIC or fixing LAA, restart.



Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like