A ping, a log file and a sort revealed our phantom server. The network segment suggested its approximate location in the building. Systems people didn't remember the precise location, but lab people remembered some equipment being moved, and with their help we finally found it.

It was sequestered in a closet barricaded by buckets of spare parts ,and it ran a dialect of SCO Unix that was several operating system versions behind. No one knew the device was there. It had been moved when a former manager renovated the UPS, and he retired before taking it out of service. Staff from that time were long since gone.

The device was a clinical lab server monitoring communication with data acquisition equipment. It ran silently performing its routine task and periodically issued a LAM (Look-At-ME!) alert when it was in distress. The LAM messages passed through the network unheeded until they collided with other server message blocks. These collisions appeared as system aberrations.

The lessons learned? Know your network. Document your resources. Scan your range.

Sometimes a little low-tech common sense will resolve an unusual ghost in your network.