18

While trying to setup a MSSQL clustering solution, I am running into a problem that is outside of my expertise that is related to networking.

I was trying to find a free IP to used for my node. I asked the network admin to give me a free IP address. And for argument sake he gave me an IP of 10.40.1.205 which supposed to be unused.

When trying to use the given IP during clustering setup, SQL complaint that the IP has been used.

I tried pinging the IP from my server and I got a reply back from say... 10.40.59.69...?

Any idea what might be causing something like this and more importantly how to troubleshoot it?

splattne
  • 28,348
  • 19
  • 97
  • 147
Jimmy Chandra
  • 311
  • 1
  • 3
  • 8

6 Answers6

14

This isn't totally unheard of, a machine may have had an alias assigned to a network card previously which the network admin doesn't know about, etc.

The obvious thing to do is find the MAC address of the responding server, that should be easy to do.

Run "arp -a" from a command prompt on the SQL server, and look for both the 10.40.1.205 and 10.40.59.69 addresses.

You'll see a MAC address for both, which might or might not be the same, they'll look like "00-22-6b-3b-30-90". Your network admin should be able to identify the network card with the MAC addresses listed, but it's probably worth checking that it's not one of the SQL server network cards before you tell him, just in case it's not a minor configuration mistake you've made yourself somewhere along the line.

To check a windows system MAC address run "ipconfig /all" from the command prompt, and you'll see a MAC address for each network card.

Ewan Leith
  • 1,695
  • 8
  • 7
3

Several possibilities:

  1. Broadcast address. If your "let's say" examples weren't precise, you could have been pinging the broadcast address on the subnet. Let's say the network was 10.40.1.0/25 (AKA mask of 255.255.255.128) and you pinged 10.40.1.127 - it may look like just a random host, but it's really the broadcast address, and anyone on that subnet could respond with their own address (FYI the broadcast address is the last address of the subnet).

  2. VIP. If you have load-balancers or a server cluster, you may have pinged the shared/virtual address and gotten a reply from the real server.

  3. Secondary addresses. If the router/server has a primary address of .69 with a secondary of .205 (common practice for people trying to reserve extra addresses seen by ping scans just like yours) it might reply to a ping for .205 but source the reply from .69.

  4. Your own address. An example from a Unix laptop: ping 192.168.1.199 responded with From 192.168.1.3 icmp_seq=1 Destination Host Unreachable where 192.168.1.3 was the laptop's IP address.

Community
  • 1
Geoff
  • 238
  • 2
  • 4
1

I'd like to see the output. Are you sure it wasn't a ICMP error message?

If your subnet mask were configured incorrectly, the router might respond to the ping. What was the subnet mask you were given?

Wade Williams
  • 178
  • 1
  • 5
0

If you have a network admin assigning IP addresses, the same network admin should be able to troubleshoot the response. It's possible that a machine has multiple NICs (and therefore multiple IP addresses).

Beep beep
  • 1,843
  • 2
  • 18
  • 33
  • Hmm... not quite the answer that I am looking for. The network admin is "sure" that the particular IP address he assigned to me is free. So let's just say that he might not know where the problem as well... – Jimmy Chandra Dec 17 '09 at 04:27
  • 1
    But wouldn't he be able to ping it and see that it is not free? Unless he is incompetent or lazy, I'm sure he would want to know about this and resolve it (or at least give you a new IP). – Beep beep Dec 17 '09 at 04:44
  • Hmm... let me put it a different way... Is it possible that when he ping it it does not get any response and when I ping it, it is replying through a different IP address? If so, what might be causing it? – Jimmy Chandra Dec 17 '09 at 05:15
  • If you're on different subnets or separated by any kind of firewall/router then it's possible that you could see different results if there's a screwy configuration in there. – Chris W Dec 17 '09 at 10:10
0

Try to resolve that IP address into a hostname. ping -a <IP> in Windows. Linux can use host <IP> or dig -x <IP>. The hostname of that IP address might be useful to you or your network admin. (I'd try resolving both IPs you're dealing with)

It's also not impossible that the ping response might be an ICMP error message -- you can try dumping the actual packets with tcpdump/Wireshark, and see exactly what you're getting in response.

You can also try connecting to that IP address with HTTP, HTTPS, SSH, telnet, RDP, etc. If any of those connect, you'll probably get some real useful info on what the machine is.

Christopher Karel
  • 6,442
  • 1
  • 26
  • 34
0

Given where it appears to reside on your network it sounds like a VIP to me, does it always respond back from the same IP? Is it's MAC address come from a valid NIC-vendor's range?

Chopper3
  • 100,240
  • 9
  • 106
  • 238