IP Conflict

[Grommit]

Hi

 

Have 600 PC's and 10 Servers..

 

I have a IP conflict with my main DC server 192.168.1.1

 

Now 192.168.1.1 to 150 are reserved and the Server has the Static IP..

 

Suddenly theyre is and IP Conflict..

 

How to I find which PC has the conflicting IP Address as in the DHCP Leases it doesn't say

[Geoff]

Use wireshark and monitor the arp broadcasts. You should be able to determine the machines MAC address from this. Then consult your hardware inventory to determine the device that contains said network card.

[SYNACK]

Wireshark http://www.wireshark.org/ ,if you don't have a full inventory of all of the MAC addresses you can at least narrow it down to a manufacturer as the first half of the MAC address will tell you the manufacturer http://www.coffer.com/mac_find/

[maniac]

If you've got managed switches, you should be able to narrow down the swich the item is connected to by looking at the port address tables within the switchs once you know the MAC address.

 

Mike.

[enjay]

If you've got .1 to .150 reserved and its not in the DHCP lease, then you're probably looking for a pre-configured device which someone has connected - unless you've recently added any new print servers, switches or APs, your culprit is most likely someone's personal laptop.

 

Typing tracert 192.168.1.1 into a DOS prompt should resolve the name for you, which might aid you in identifying what - and therefore where - it is.

[Guest Guest]

Yeah, just disconnect the server from the network

 

cmd

ping 192.168.1.?

arp -a

 

Now you've got the mac address.

[Disease]

You have probably put a router or something like that on the network which has it's static IP defaulted to 192.168.1.1, either that or someone has plugged one into a network socket somewhere.

[enjay]

cmd

ping 192.168.1.?

arp -a

 

Now you've got the mac address.

That only works if you're connected to the same physical switch as the device in question, which he's obviously not.

[Guest Guest]

cmd

ping 192.168.1.?

arp -a

 

Now you've got the mac address.

That only works if you're connected to the same physical switch as the device in question, which he's obviously not.

 

Why would it matter?

[steveg]

Try disconecting the server and accessing the IP address through a web browser. 192.168.1.1 is the default address for a number of pieces of hardware, most of which will have a web interface. Might give you a clue what your looking for.

 

Steve

[Grommit]

Thanks Guys...... Working on it now....

[enjay]

Why would it matter?

It matters because when I tried it here just now, I only saw devices on the same switch as me, so I don't see how it would help to track down the rogue device, as it could be anywhere on the network. I suppose you could go round every switch in turn, but that could be a lengthy process.

[SYNACK]

Why would it matter?

It matters because when I tried it here just now, I only saw devices on the same switch as me, so I don't see how it would help to track down the rogue device, as it could be anywhere on the network. I suppose you could go round every switch in turn, but that could be a lengthy process.

 

This should work so long as the system is on the same subnet as your station. If it is on a different subnet you will get the MAC address of the local router interface returned instead. This happens because MAC addresses are not routeable they are layer 2 only (OSI Model)

[enjay]

I'm only saying what I found when I did it here - all I got were the devices on the same switch as me.

 

If it were on a different subnet, it wouldn't be conflicting with the server, would it?

[PiqueABoo]

all I got were the devices on the same switch as me.

 

Not saying it didn't happen for some unknown reason, but responses limited to devices on the same switch is not normal. ARP should work for any device with a working TCP/IP stack on the same subnet.

 

[Wrote a win32 ARP scanner eons ago (spits out MACs, vendors, DNS etc.) and that has always received the expected responses]

[SYNACK]

If it were on a different subnet, it wouldn't be conflicting with the server, would it?

 

Just to clarify, I did say the same subnet as your station rather than same subnet as the server. Your statement depends on your management stations and servers being on the same subnet.

[webman]

nmap on linux might be able to help, this command should give you some information to go off:

 

nmap -sS -O -vv 192.168.1.1

[richard.thomas]

Try to command: nbtstat -a 192.168.1.1

If it's running windows you'll get a name- Hope you work it out!

[Lee_K_81]

192.x.x.x is a reserved ip range (only used for internal addressing on a network) http://www.duxcw.com/faq/network/privip.htm

 

192.168.1.1 is usually a router, not an ip address given to a client. This might sound like a silly suggestion, but if you search for a wireless signal do you get any that you think shouldnt be there? I wouldnt be suprised if a "tech literate" teacher (is there such a thing?) has gone out and bought, or brought in, their own wireless router so that they dont have to have a cable hanging. Not many people would realise that a wireless router (with DHCP) and a wireless access point are different, and the wrong one could cause no end of trouble, failing that if it's not wireless, maybe just a router, maybe someone who shares an office or has a shortage of network sockets???

 

Hope this helps.

[Grommit]

192.168.1.1 is my server IP

 

What is the best cheap/free PC Audit software.. one that will get me the mac numbers...

 

As I have the Mac number but it is a make of Network card that we have hundreds of..

[maniac]

Easy way to track this down, but you can only do it when no one's using your network, and assuming you have a setup where you can easily isolate sections of your network.

 

1.Set it pinging on a workstation connected to your central switch.

 

2. Pull out each fibre in turn, until the ping is un-responsive. Bingo, you know which section of the network it's on.

 

Then you can repeat the same process in that section of the network, find out which switch it is, and then finally narrow it down to a port by doing the same thing on the switch.

 

Might take you a little while to do this, but IMO it's far easier than loading on fancy diagnostics tools to try and find it.

 

Mike.

[Osprey]

Spiceworks will do an audit of all networked equipment including mac addresses. Also does help desk. And it's free. If only it would make the tea!

[Lee_K_81]

192.168.1.1 is my server IP

 

When i said 192.168.1.1 is usually a router i was suggesting in a domestic setup. I know you have set your server to be that. I was merely suggesting that the conflict maybe because somebody has bought device in from home. Maniac's suggestion on how to find the exact location is a good one. you may also need to unplug the sever also.

[Michael]

As a general rule I would never set a server (especially a DC) as 192.168.1.1, as already mentioned - this is typically the default for routers or access points.

 

Clearly this is causing a major problem and my recommendation would be to set the DC as 192.168.1.10 (as a minimum), irrelevant if it's in a reserved range or not.

 

Not only will it minimise the chance of this happening again, once you've made the necessary changes, you'll be able to quickly identify just what device on your network is causing the conflict. I do suspect it is a router/access point as they always come with a static IP address in the Class C range.

[PiqueABoo]

I do suspect it is a router/access point

 

That would be my chief suspect, but Grommit said it's one of hundreds of NICs from a given vendor i.e. implies it's a workstation.

 

If that nbtstat command doesn't do it (give you a Windows name which helps track it down) then rather than start unplugging things which hurts your fingers after a while, I'd telnet to switches and ask them what MACs they've got associated with which ports. Whether and how you can do that depends on your switches. For instance on an HP you can use this command:

 

show mac-address

 

IIRC there's another command you can feed a specific MAC which returns the port number (if any).