Event ID 4319 driving me nuts

  • Thread starter Thread starter Darren Thorley
  • Start date Start date
D

Darren Thorley

I am getting the following error message frequently:
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4319
Date: 24/07/2003
Time: 21:02:54
User: N/A
Computer: FSMSQL
Description:
A duplicate name has been detected on the TCP network. The IP address
of the machine that sent the message is in the data. Use nbtstat -n in
a command window to see which name is in the Conflict state.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 01 a8 c0 ..¨À

I have followed the instructions and everything seems fine, nothing in
conflict

Local Area Connection 2:
Node IpAddress: [192.168.1.6] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
FSMSQL <00> UNIQUE Registered
FSMSQL <20> UNIQUE Registered
FSM <00> GROUP Registered
FSM <1C> GROUP Registered
FSM <1E> GROUP Registered
FSMSQL <03> UNIQUE Registered
INet~Services <1C> GROUP Registered
IS~FSMSQL......<00> UNIQUE Registered
This is a multihomed server running SQL and running as a DC. The other
network card has been disabled. What am I missing as I would like to
get rid of this message from the event viewer.

Thanks in advance for any advice given.

Darren
 
Thanks very much for getting back to me. Just so I know, how did you
work that out? I would like to learn so I can sort it out for myself
in the future, should I ever see this again. Is there a KB article
that I can use to correct the fault as that IP address is another DC
that was upgraded from the NT4 PDC. There is no WINS running on the
domain, just DNS.

Thanks again,

Darren

Bob I said:
The address of the conflict is 192.168.1.2

Darren said:
I am getting the following error message frequently:
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4319
Date: 24/07/2003
Time: 21:02:54
User: N/A
Computer: FSMSQL
Description:
A duplicate name has been detected on the TCP network. The IP address
of the machine that sent the message is in the data. Use nbtstat -n in
a command window to see which name is in the Conflict state.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 01 a8 c0 ..¨À

I have followed the instructions and everything seems fine, nothing in
conflict

Local Area Connection 2:
Node IpAddress: [192.168.1.6] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
FSMSQL <00> UNIQUE Registered
FSMSQL <20> UNIQUE Registered
FSM <00> GROUP Registered
FSM <1C> GROUP Registered
FSM <1E> GROUP Registered
FSMSQL <03> UNIQUE Registered
INet~Services <1C> GROUP Registered
IS~FSMSQL......<00> UNIQUE Registered
This is a multihomed server running SQL and running as a DC. The other
network card has been disabled. What am I missing as I would like to
get rid of this message from the event viewer.

Thanks in advance for any advice given.

Darren
Click to expand...
Click to expand...
 
There does not seem to be a problem with the server with the IP
address, unless I am totally misreading the results. If there was a
problem should I expect it to say conflict instead of registered?

Local Area Connection 2:
Node IpAddress: [192.168.1.2] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
FSMPDC <00> UNIQUE Registered
FSMPDC <20> UNIQUE Registered
FSM <00> GROUP Registered
FSM <1C> GROUP Registered
FSM <1B> UNIQUE Registered
FSM <1E> GROUP Registered
FSMPDC <03> UNIQUE Registered
FSM <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered
ADMINISTRATOR <03> UNIQUE Registered

Have I missed something? Where do I go from here?

Thanks

Darren

Bob I said:
From your dump

"The IP address of the machine that sent the message is in the data."

"0028: 02 01 a8 c0 ..¨À "

Read right to left

c0 = 192
a8 = 168
01 = 1
02 = 2

An easy way to get the decimal if you don't work with it much is to open
Calculator in Scientific View then press the HEX button and put in "C0"
and then press DEC and you will see "192" then switch back to HEX plug
in "a8" -> DEC shows "168"

now you're good to go.


Darren said:
Thanks very much for getting back to me. Just so I know, how did you
work that out? I would like to learn so I can sort it out for myself
in the future, should I ever see this again. Is there a KB article
that I can use to correct the fault as that IP address is another DC
that was upgraded from the NT4 PDC. There is no WINS running on the
domain, just DNS.

Thanks again,

Darren

Bob I said:
The address of the conflict is 192.168.1.2

Darren Thorley wrote:


I am getting the following error message frequently:
Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4319
Date: 24/07/2003
Time: 21:02:54
User: N/A
Computer: FSMSQL
Description:
A duplicate name has been detected on the TCP network. The IP address
of the machine that sent the message is in the data. Use nbtstat -n in
a command window to see which name is in the Conflict state.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 01 a8 c0 ..¨À

I have followed the instructions and everything seems fine, nothing in
conflict

Local Area Connection 2:
Node IpAddress: [192.168.1.6] Scope Id: []

NetBIOS Local Name Table

Name Type Status
---------------------------------------------
FSMSQL <00> UNIQUE Registered
FSMSQL <20> UNIQUE Registered
FSM <00> GROUP Registered
FSM <1C> GROUP Registered
FSM <1E> GROUP Registered
FSMSQL <03> UNIQUE Registered
INet~Services <1C> GROUP Registered
IS~FSMSQL......<00> UNIQUE Registered
This is a multihomed server running SQL and running as a DC. The other
network card has been disabled. What am I missing as I would like to
get rid of this message from the event viewer.

Thanks in advance for any advice given.

Darren
Click to expand...
Click to expand...
Click to expand...
 
Back
Top