I remember one occasion ~2002 where a new NIC with a duplicate MAC addresses took down our DC - the whole IT team was floundering for hours before the cause was discovered after I noticed it in Snort logs. I have a strong interest in infosec, and I'd fought hard to get that Snort tap installed only a couple of weeks previously :)