Network adapter responds to ARP or NS requests for incorrect IP addresses in Windows 7

Applies to: Windows 7 ProfessionalWindows 7 EnterpriseWindows 7 Ultimate

Symptoms

Consider the following scenario:
  • The ARP offload and NS offload features are enabled on a computer that is running Windows 7 in a network environment.
  • The computer obtains an IP address from the DHCP server.
  • The computer enters sleep mode.
  • The computer resumes from sleep mode and obtains a different IP address. For example, this behavior may occur because the DHCP lease is expired or because the computer connects to a different subnet.
  • The computer enters sleep mode again.
In this scenario, the ARP offload and NS offload address list that is maintained in the miniport driver is not updated by using the most recent IP address. Therefore, the network adapter responds to incorrect ARP or NS requests, and you receive notifications of duplicate IP addresses in the subnet.

Cause

This issue occurs because Tcpip.sys sends a notification to remove the old IP address before the miniport driver is ready to receive notifications. Therefore, the old IP address remains in the ARP offload and NS offload address list. If the list is filled up by using the old IP address, the new IP address cannot be downloaded. 

Resolution

A fix is available to resolve this problem. The fix is included in security update 2688338 (MS12-032). 

For more information or to download the update, click the following article number to view the article in the Microsoft Knowledge Base:
2688338 MS12-032: Vulnerability in TCP/IP could allow elevation of privilege: May 8, 2012

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates