Duplicate IP detection using NMAP

[mattx]

Got a bit of a duplicate IP address problem I think on one of our subnets. I'm looking at Nmap at the moment to knock out an all subnet arp request to hopefully narrow it down. Problem is I'm having a problem with the correct syntax - can anyone else help or let me know how they have solved this type of problem ?

Thanks.

[Jona]

If you have a particular suspect ip address and access to a linux command line I like to use:

arping -b ipaddress

If you get replies from two different mac addresses then you have a conflict.

[PiqueABoo]

What's complaining about duplicates? Windows logs an event when it detects a conflict and that contains the MAC of the conflicting device (or at least that was true for XP/2003). Having got that, if the OUI doesn't tell me what+where it is I've gone to the switches to find out what port the MAC "lives on", starting from the switch the complaining device is plugged into and following it wherever it leads.

[mattx]

If you have a particular suspect ip address and access to a linux command line I like to use:

arping -b ipaddress

If you get replies from two different mac addresses then you have a conflict.

 

May be worth blowing the cobwebs off the linux box then for that. Will give that a try.

[mattx]

What's complaining about duplicates? Windows logs an event when it detects a conflict and that contains the MAC of the conflicting device (or at least that was true for XP/2003). Having got that, if the OUI doesn't tell me what+where it is I've gone to the switches to find out what port the MAC "lives on", starting from the switch the complaining device is plugged into and following it wherever it leads.

 

I have an old 2003 server which is running vpop3 which in turn has a few of our MFPs hanging off it - and when I say a few I mean over 40 from our global offices. Whats happening is that the IP its using then drops off the network resulting in problems. In the event log and pop up messages I'm seing conflict reports plus I'm seing a few work stations report similar issues.

This could be a red herring as we have just moved offices and we stuck everything on a new subnet. I've manaegd to sort out most of the DNS related issues but this one I hope if the final one to solve.....well at least for a while.

[Mehmet]

Let us know how you get on!

[mattx]

Oh yes, found it - I used this site:

 

MAC_Find: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

 

And stuck in the MAC hoping it would at least give me a clue as to the model of device to look for. As soon as it returned the result I knew what it was....... > cough < - yes, my fault..... :-)

[Geoff]

If you can't find it that way, also note that managed switches will usually let you ask them about a mac address and tell you what port it has learned it on.