Tracking down duplicate IP

mtrox

On a network I've run for about a month now. It's a mess. One of my problems is that every now and then I get a duplicate IP error on my laptop. Event viewer gives me a MAC address, and the first three octets tell me the card was made my Apple. The MAC doesn't show up in DHCP tables so I assume someone has plugged in a static IP inside the scope.

How do you guys track down a duplicate IP in this situation? Oh, it's about 50 devices in a small 3 story building so I'm not inclined to run to every computer.

kryyst

do a reverse ping and see if that can find the name for the dup IP. That may give you a hint. Otherwise, hunt and peck through 50 computers or look for the 1 mac if you are primarily a pc shop.

mtrox

Already tried the ping. Nada. And the shop is about half PC's and half Macs.

Also in the back of my mind is that this network is run by a Comcast SMC8014 cable modem/router. I Googled that and there are lots and lots of posts with frustrations with that thing. Could it be some old lease that's still stuck in the router? I'm not sure how that error gets generated.

Kwitko

try Angry IP Scanner. If that doesn't help track down the duplicate machines, check out this article: http://aplawrence.com/Unixart/duplicate_ip_address.html

mtrox

Thanks Kwitco. I'm there again on Tues and I'll try that. Good article. He brought up something I haven't completely discounted in this mess......another DHCP server. My addresses are 10.1.10's so it seems unlikely someone has brought in a Linksys residential thing.

ardichoke

Not sure what kind of infrastructure you have, but if you're using commercial switches you should be able to use their interface to track down what switch and port the MAC address of the duper is hooked to. From there you just need to figure out where that port runs to.