How can I find an IP conflict device when it doesn't resp to ping or scans

[schunks]

I'm getting an ip conflict and want to track to the port where the device is. The device doesn't respond to pings or port scans and does not show up in ciscoworks. Is there some tool to get more info about the rogue device?

[Richard Burts]

Scott

Does the device that reports the address conflict include the MAC address of the other device (many devices do include this information)? If so you may be able to track the MAC address by doing show cam dynamic or show mac-address-table (depending on type of switch) and find the port where the device is located).

HTH

Rick

[mironduplessis]

Hi,

What you could try doing is check the ARP entries in the Router. That should give you the corresponding MAC adddress which you can then trace on the switch. Even though the machine has a firewall its ARP entry should be in the router otherwise it would not be able to send traffic out ofthe subnet. You may have to take the second machine off first before trying otherwise you will get the MAC of the legit PC.

Miron

[georg.tresselt]

Based on the IP address, you should know the default gateway. There I would check the ARP cache to find out the MAC address. Then you would have to search through the switches forwarding tables to locate this MAC address.

[schunks]

The mac address was the routers ethernet port and ultimately ended up having a bogus nat association to the ip address. I don't quite understand how having a nat entry for the ip address would generate an ip conflict on my lan, but there it is. Thanks for the responses.