Troubleshooting duplicate IP

[spidey07]

It happens. Somehow, someway you have got really strange stuff going on. Very intermittent connectivity with applications or just flat out not working. Web pages extremely slow, partial loading, connections reset constantly. But for some reason pings don't time out. As a last ditch effort you decide to check layer2/3 to see what's going on and you suspect possible a duplicate IP because it's just a single host.

To troubleshoot look at ARP tables on the machine's default gateway. You'll see the router periodically has a different MAC for the same IP address. Or you'll see the ARP time for that entry is very low and stays that way. You can also clear the ARP entry and check a few times and see the entry change. Those are two dead giveaways that you have two MAC addresses with the same IP.

Then go through the switch MAC table, find one of the MACs and disable the port. That should resolve the application troubles and give time to hunt down the person that caused this atrocity.

 

[kevnich2]

Awesome troubleshooting post there Spidey! Duplicate IP's are sometimes a headache to troubleshoot.

 

[freegeeks]

another fun one is asymmetrical routing on a statefull firewall with tcp-syn check enabled.
clients are complaining that their application is not working but you ping the machine just fine so connectivity looks ok, until you do a traceroute and notice that your SYN is going out interface A and the SYN-ACK returns through interface B and the firewall just drops the tcp session

 

[boomerang]

Had a printer that was set up sharing an IP once when I was a working stiff. Spontaneous printing of gobbeldygook. The other printer was a plotter and mine was a dot-matrix.