Windows 2000 NAT DHCP Allocator Service Logs Event 30001

A Windows 2000-based server running the Network Address Translation (NAT) service with the DHCP allocator function may log the following system event where x.x.x.x is the IP address that NAT is attempting to lease out to a client, and X.X.X.X is the IP address of the interface running the DHCP allocator service in NAT.

There is a host on the network which has a duplicate of an IP address in NAT's DHCP pool of addresses.

To resolve this issue, use either of the following methods:

• Change the IP address on the offending host (that which already has the IP address).
• Exclude the specific IP address from the DHCP allocator range in NAT.

You can identify the host with the undesired duplicate IP address in one of the following ways:

• On the NAT server's ARP cache, there may be a mapping of the IP address in conflict to the MAC address of the offending computer. The network administrator would then need to determine which specific computers had the given MAC address. To display the ARP cache on the NAT server, perform the arp -a command on the NAT server at a command prompt.
• In some circumstances the DHCP client may display a message indicating the conflict and specifying the MAC address of the offending computer.
• Temporarily remove the DHCP client from the network, and from a Microsoft machine on the network, perform the following command at a command prompt
  nbtstat -a x.x.x.x
  where x.x.x.x is the address in conflict. If the offending host on the network is running a Microsoft operating system, the above command should return a list of the NetBIOS names the remote host is listening on. This may assist you in further determining which specific computer has the address in conflict.

To suppress the error message from being written to the event log, change the logging level of the NAT service to log errors only. This does not resolve the root cause of the problem, but it does prevent the warning from being logged in the system log.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Before the DHCP allocator service in NAT gives a client a lease for a particular IP address, it sends an ARP request for the IP (a gratuitous ARP) to see if the address is already in use. If a computer (or network device) responds to this ARP request, the DHCP allocator service logs this warning, and tries to issue the next available IP address in the DHCP scope.