It started munanely enough. A couple of people could not print to the network printer at the reception desk. Restarting the PCs [hey, with Windows 98 you never know!] and the printer had no effect.
Then someone could not read their e-mail. Also not that uncommon. However, for some reason, he mentioned his IP address. His laptop was using my IP address: 192.168.2.4. Besides, that ethernet jack was supposed to be on 192.168.1.*, not 192.168.2.*.
Searching for clues, I ran ipconfig/all. The laptop had got its IP address through DHCP from 169.254.228.128. WTF? 169.254.* is for auto config. And what was wrong with our normal server?
By now, several people reported various problems. A hunt through the office turned up 169.254.228.128: it was a Mac laptop that someone had brought in this morning. He had enabled some network sharing at home and thought no more of it since.
The system event log on our server had two DHCP-related entries:
The DHCP/BINL service ... has encountered another server on this network with IP Address 192.168.1.116, belonging to the domain: .
The DHCP/BINL service on this computer is shutting down. See the previous event log messages for reasons.
After that, it seems the rogue Mac reverted to using a 169.254.* address but kept answering DHCP requests with IP addresses in the 192.168.2.* range.
Solution: stop the DHCP server on the Mac, restart the DHCP service on our server and ipconfig/release/renew on the affected PCs. (Or reboot in the case of Windows 98. Life is too short...)