We have a duplicated IP address somewhere within a subnet. However, I can't find where the illegal one is. There is no related record on arp or ciscoworks or syslog. The legal PC, which uses DHCP, gets a message saying IP address conflict once a couple of days. After having disabled by this conflict once, the legal PC now works fine though.
Any other idea how I can find the MAC or location of the illegal one?
By the way, my understanding is that there is a DAD mechanism within DHCP server that prevents duplicated IP before it gets on the network. So, how can that message come up?
Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.
i came across this problem few years ago.....and thats what i did.