tariq barakat May 18, 2026 · 5:26 PM

users randomly losing connection to file server throughout the day

hey, having a weird one. some of our users are randomly dropping connection to the main file server during the day. it comes back on its own after a minute or two but its been happening a few times a day and people are getting annoyed. weird part is its not everyone, some users seem completely unaffected. server itself looks fine from what i can tell. not sure where to start with this one, any ideas?

7 Comments

sara alotaibi May 18, 2026 · 5:48 PM

few questions before we start guessing: - wired or wireless? or a mix? - when it drops, can the affected users ping the server IP directly or is it just the file share that dies? - is it always the same users getting hit or random each time? - anything change on the network recently? new devices, config changes, anything at all?

tariq barakat May 18, 2026 · 6:01 PM

all wired, no wifi in the mix. yeah ping fails too when it happens, not just the share. and its definitely the same 3-4 users every time, the others are totally fine. as for changes, we added a few new machines last week but nothing else really. server cpu/ram look normal and theres nothing in event viewer.

ahmed alrashid May 18, 2026 · 6:14 PM

ok the same users every time is a useful clue. are those users physically near each other or on the same switch? and when it happens, can they still reach other servers or is it only this one file server that goes down for them? also, is the file server on DHCP or a static IP?

tariq barakat May 18, 2026 · 6:28 PM

yeah now that you mention it, all 3 affected users are on the 2nd floor switch. and yes everything else works for them when it happens, just this server. they can reach the internet, other servers, printers, everything. server has a static IP, 192.168.1.50, been that way for like 3 years. actually one of the affected machines cant ping it right now if that helps.

ahmed alrashid May 18, 2026 · 6:40 PM

ok run this on one of the affected machines right now while it cant ping: arp -a | findstr 192.168.1.50 what MAC address does it show? then RDP or physically check the server itself and run the same command — ipconfig /all and look at the physical address. if the MACs dont match, something else on the network grabbed that IP. those new machines from last week are the first thing id check.

khaled almansour May 18, 2026 · 6:47 PM

adds up. if the duplicate device is sitting on the 2nd floor switch it would poison the ARP cache specifically for machines on that switch. users on other switches would still hit the router's cached ARP entry for the real server, which is why they're unaffected. you can also check the switch itself — "show mac address-table | include [last 4 of server MAC]" and see if that MAC is appearing on more than one port.

tariq barakat May 18, 2026 · 7:31 PM

...yeah it was a duplicate IP. ran arp -a and got a completely different MAC for 192.168.1.50. tracked it through the switch and it was one of the new printers added last week. whoever set it up gave it a static IP and just picked .50 without checking anything. changed the printer to .78 which was free, cleared the arp caches, everything has been solid for the past hour. i feel a bit dumb for not thinking of duplicate IP sooner lol. thanks both, the arp tip was what cracked it.