Pinpoint a duplicated IP address.

Answered Question

We have a duplicated IP address somewhere within a subnet. However, I can't find where the illegal one is. There is no related record on arp or ciscoworks or syslog. The legal PC, which uses DHCP, gets a message saying IP address conflict once a couple of days. After having disabled by this conflict once, the legal PC now works fine though.

Any other idea how I can find the MAC or location of the illegal one?

By the way, my understanding is that there is a DAD mechanism within DHCP server that prevents duplicated IP before it gets on the network. So, how can that message come up?

Thanks,

Han,


Correct Answer by MUHAMMAD SHAHEEN about 9 years 5 months ago

Hi,


Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.


i came across this problem few years ago.....and thats what i did.


HTH

Shaheen

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Danilo Dy Wed, 12/19/2007 - 05:35
User Badges:
  • Blue, 1500 points or more

Hi,


If your DHCP server is a Windows Server, there is a way to track the culprit. Take a look at this link http://www.webopedia.com/DidYouKnow/Internet/2007/IP_Address_Conflicts.asp then assign an invalid IP to the MAC Address in your L3 device (gateway of the users) and wait for the user to come to you and you can find out why the user PC always create problem for you - take note that the user may be ignorant to it (i.e. his/her PC may have go into sleep mode and wake up after few days) but users who statically configure IP address without informing DHCP or network administrators should be punish


In a large user environment, I use Windows Server as DHCP for the reason that I can track erring users.


Regards,

Dandy

Danilo Dy Wed, 12/19/2007 - 05:50
User Badges:
  • Blue, 1500 points or more

Hi,


I know QIP (DNS/DHCP), one of my customer uses it - its a pain to setup and configure but once its running, whoa!


I don't think there is a utility to find the culprit in QIP.


If you have a Linux/UNIX host in the network, perform an ARPING to find out the MAC Address of the PC that causes duplicate IP Address


A sample ARPING from RH ES 4 (Linux)

$ sudo arping -I eth0 -c 3 192.168.1.1

ARPING 192.168.1.1 from 192.168.1.200 eth0

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 3.280ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.163ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.185ms

Sent 3 probes (1 broadcast(s))

Received 3 response(s)


Here's the link http://www.cyberciti.biz/faq/linux-duplicate-address-detection-with-arping/


Regards,

Dandy

Danilo Dy Wed, 12/19/2007 - 06:29
User Badges:
  • Blue, 1500 points or more

Hi,


Its not that hard to setup a Linux. You only need it anyway to find the culprit :).


I think there are freely available ARPING utility for Windows. Try to Google it :)


Regards,

Dandy

Correct Answer
MUHAMMAD SHAHEEN Wed, 12/19/2007 - 07:07
User Badges:
  • Silver, 250 points or more

Hi,


Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.


i came across this problem few years ago.....and thats what i did.


HTH

Shaheen

hobbe Thu, 12/20/2007 - 04:09
User Badges:
  • Gold, 750 points or more

This is a variation on the last post.

First you take the pc that you know the max address off and turn it off.

then you ping the ip address that is offending, then you do a arp -a to get the mac address out of your machine.

Then you go to the switches and look for the right port wich sees this mac address.

fx with the sh ma add command


Good luck



Actions

This Discussion