On one of the computers on a small local area changes automatically mac address in the arp table?

The company has a network of about 50 machines, 100BASE-TX. No DHCP, all addresses static, of the form 192.168.1.xxx (mask 255.255.255.0). On all Windows XP machines, go to the Internet through a proxy server (192.168.1.1). The problem appeared suddenly on one of the machines (192.168.1.76). Several times a day it loses connection with the server (does not go ping, don't go packages, etc.). Helped "fix" the network connection. Found that at the time when the connection is lost, the mac address of this machine becomes the same as the server. Accordingly, if you submit a command for clearing the arp cache (arp-d) connection is immediately restored. At the same ipconfig /all shows the correct mac. Virus scan found nothing. Replacing the network card did not help. Assigning mac addresses to static did not help. The program arpwatch (found in the article ru.wikipedia.org/wiki/ARP-spoofing ) writes something in the spirit of "mac address was changed" (sorry, the exact wording I do not remember, I write from the house).

What could be the reason for such miracles?
October 8th 19 at 02:34
6 answers
October 8th 19 at 02:36
Ponipate traffic so that you had the log of packets at the time of changing the Mac address. Well... and then understand what to do.
Tried versacom look like anything suspicious did not notice. I'll try again, more closely. Oh, I forgot to say, there is a certain relationship between the failure of network, and open any site in browser. Ie work-work have opened any site in the browser, with some probability at this point, the network disappears. As it is not like an external attack, I think so... - viva.Turcotte37 commented on October 8th 19 at 02:39
October 8th 19 at 02:38
VIR be caught repeatedly in LAN — http://en.wikipedia.org/wiki/ARP_spoofing
Injecter malicious script to web pages of other users.
October 8th 19 at 02:40
Antivirus will save you.
October 8th 19 at 02:42
The reason is definitely inside your network. And there are two options. Either someone intentionally breaks the arp or on one of the machines the virus just. For the network admin it all still boils down to one option, one of 50 car trying to engage in spoofing. If you do not know exactly which of them, then writing the network and then analyzed in the same Versace, if the machine is accurately known and antiviri silent, then it is better to reinstall.
October 8th 19 at 02:44
Okay, I'll pick...
October 8th 19 at 02:46
In short, it all ended like that. Viruses found peremknulo the computer on which you changed the mac to a different switch and the problem went away. 2 weeks normal flight. What it was, I don't understand.

Find more questions by tags Computer networks