cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1605
Views
5
Helpful
7
Replies

Pinpoint a duplicated IP address.

wuh
Level 1
Level 1

We have a duplicated IP address somewhere within a subnet. However, I can't find where the illegal one is. There is no related record on arp or ciscoworks or syslog. The legal PC, which uses DHCP, gets a message saying IP address conflict once a couple of days. After having disabled by this conflict once, the legal PC now works fine though.

Any other idea how I can find the MAC or location of the illegal one?

By the way, my understanding is that there is a DAD mechanism within DHCP server that prevents duplicated IP before it gets on the network. So, how can that message come up?

Thanks,

Han,

1 Accepted Solution

Accepted Solutions

Hi,

Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.

i came across this problem few years ago.....and thats what i did.

HTH

Shaheen

View solution in original post

7 Replies 7

Danilo Dy
VIP Alumni
VIP Alumni

Hi,

If your DHCP server is a Windows Server, there is a way to track the culprit. Take a look at this link http://www.webopedia.com/DidYouKnow/Internet/2007/IP_Address_Conflicts.asp then assign an invalid IP to the MAC Address in your L3 device (gateway of the users) and wait for the user to come to you and you can find out why the user PC always create problem for you - take note that the user may be ignorant to it (i.e. his/her PC may have go into sleep mode and wake up after few days) but users who statically configure IP address without informing DHCP or network administrators should be punish

In a large user environment, I use Windows Server as DHCP for the reason that I can track erring users.

Regards,

Dandy

Dandy,

thanks, but we dont use windows server. Our dhcp server is qip.

thanks,

Han

Hi,

I know QIP (DNS/DHCP), one of my customer uses it - its a pain to setup and configure but once its running, whoa!

I don't think there is a utility to find the culprit in QIP.

If you have a Linux/UNIX host in the network, perform an ARPING to find out the MAC Address of the PC that causes duplicate IP Address

A sample ARPING from RH ES 4 (Linux)

$ sudo arping -I eth0 -c 3 192.168.1.1

ARPING 192.168.1.1 from 192.168.1.200 eth0

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 3.280ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.163ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.185ms

Sent 3 probes (1 broadcast(s))

Received 3 response(s)

Here's the link http://www.cyberciti.biz/faq/linux-duplicate-address-detection-with-arping/

Regards,

Dandy

Dandy,

thanks again, but we dont have any linux there.

Han,

Hi,

Its not that hard to setup a Linux. You only need it anyway to find the culprit :).

I think there are freely available ARPING utility for Windows. Try to Google it :)

Regards,

Dandy

Hi,

Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.

i came across this problem few years ago.....and thats what i did.

HTH

Shaheen

hobbe
Level 7
Level 7

This is a variation on the last post.

First you take the pc that you know the max address off and turn it off.

then you ping the ip address that is offending, then you do a arp -a to get the mac address out of your machine.

Then you go to the switches and look for the right port wich sees this mac address.

fx with the sh ma add command

Good luck

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco