Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

wuh
New Member

Pinpoint a duplicated IP address.

We have a duplicated IP address somewhere within a subnet. However, I can't find where the illegal one is. There is no related record on arp or ciscoworks or syslog. The legal PC, which uses DHCP, gets a message saying IP address conflict once a couple of days. After having disabled by this conflict once, the legal PC now works fine though.

Any other idea how I can find the MAC or location of the illegal one?

By the way, my understanding is that there is a DAD mechanism within DHCP server that prevents duplicated IP before it gets on the network. So, how can that message come up?

Thanks,

Han,

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Pinpoint a duplicated IP address.

Hi,

Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.

i came across this problem few years ago.....and thats what i did.

HTH

Shaheen

7 REPLIES

Re: Pinpoint a duplicated IP address.

Hi,

If your DHCP server is a Windows Server, there is a way to track the culprit. Take a look at this link http://www.webopedia.com/DidYouKnow/Internet/2007/IP_Address_Conflicts.asp then assign an invalid IP to the MAC Address in your L3 device (gateway of the users) and wait for the user to come to you and you can find out why the user PC always create problem for you - take note that the user may be ignorant to it (i.e. his/her PC may have go into sleep mode and wake up after few days) but users who statically configure IP address without informing DHCP or network administrators should be punish

In a large user environment, I use Windows Server as DHCP for the reason that I can track erring users.

Regards,

Dandy

wuh
New Member

Re: Pinpoint a duplicated IP address.

Dandy,

thanks, but we dont use windows server. Our dhcp server is qip.

thanks,

Han

Re: Pinpoint a duplicated IP address.

Hi,

I know QIP (DNS/DHCP), one of my customer uses it - its a pain to setup and configure but once its running, whoa!

I don't think there is a utility to find the culprit in QIP.

If you have a Linux/UNIX host in the network, perform an ARPING to find out the MAC Address of the PC that causes duplicate IP Address

A sample ARPING from RH ES 4 (Linux)

$ sudo arping -I eth0 -c 3 192.168.1.1

ARPING 192.168.1.1 from 192.168.1.200 eth0

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 3.280ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.163ms

Unicast reply from 192.168.1.1 [00:1B:2B:DE:1A:43] 1.185ms

Sent 3 probes (1 broadcast(s))

Received 3 response(s)

Here's the link http://www.cyberciti.biz/faq/linux-duplicate-address-detection-with-arping/

Regards,

Dandy

wuh
New Member

Re: Pinpoint a duplicated IP address.

Dandy,

thanks again, but we dont have any linux there.

Han,

Re: Pinpoint a duplicated IP address.

Hi,

Its not that hard to setup a Linux. You only need it anyway to find the culprit :).

I think there are freely available ARPING utility for Windows. Try to Google it :)

Regards,

Dandy

Re: Pinpoint a duplicated IP address.

Hi,

Check the event viewer of the PC which is reporting to you about a duplicate IP address. The detailed message will have mac-address for the culprit PC. Then log onto your switch and look for that mac-address in the mac table. You should be able to find which port that PC is connected to and then go to that desk.

i came across this problem few years ago.....and thats what i did.

HTH

Shaheen

Gold

Re: Pinpoint a duplicated IP address.

This is a variation on the last post.

First you take the pc that you know the max address off and turn it off.

then you ping the ip address that is offending, then you do a arp -a to get the mac address out of your machine.

Then you go to the switches and look for the right port wich sees this mac address.

fx with the sh ma add command

Good luck

491
Views
5
Helpful
7
Replies