Is there a setting in wireshark that will allow me to detect duplicate IP addresses?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Yes, two machines with the same IP address on the same network. It is possible, thats why I want detect it. It causes problems. I'm trying to figure out if Wireshark has a setting that marks/highlighs/detects duplicate IP addresses by comparing the IP address in a capture to the MAC addresses and detecting when two MAC addresses are related to the same IP address.
Well, what may happen when two IPs are set the same on different machines, is both getting disconneted due to IP "colision" (?!). I can accept that, of course.
:)
Well... The only way I found to know of a duplicate IP is to look in the Event Viewer. If you had any linux machine, you could use the "arping -D" command: http://linux.about.com/lib
yes you ca have two pcs with the same ip on the same network..
(at least you can set them to have them.. it wont work of course, but there is nothing physicaly stopping you do it!)
I not sure about Wireshark. have a look on there site.. i bet some one has created a filter/script to detect them some where!
however I use observer (wire shark on sterioids) to do network captures and this does indeed flag up duplicate addresses.
also it would depend on you being sure of what is the duplicated IP address.
If you are not sure or suspect you have several it could become a pain serching for them.
rember also the NIC you are serching with will need to be in the same subnet as the duplicated IP address.
Accross routers all remote ip addresses will have the mac address of the default gate way!!
so make sure you are testing the link for the correct place.
I( cant get that filter to work correctly Donmanrobb. It is some thing like that though?? however you could jsut do a capture of ARP traffic (only need replies). and then the packets by IP address. If any of the ip address have mnore than one mac address returned...
yes also rember that although the ARP request it a broadcast.. the responce is directed to the requesting station.
So you will not be able to ditect a duplicated ip address from a single workstaion unless..
you either know what the ip address is that is duplicated..
or you run an arp on ever IP on the network from that PC and clean out your cache inbetween each one and repet untill you see the mac change..
or else mirror a core turnking link on a switch and monitor the ARP requests on that link..
Business Accounts
Answer for Membership
by: paulop1975Posted on 2008-04-25 at 16:13:29ID: 21443796
When you say "duplicate IP addresses", do you mean two machines with the same IP address? That is just not possible. If two computers are supposed to be on the same network in the same IP range, and even if they are manually configured, as soon as one of the machine is set for IP 192.168.2.10, no other machine can be set to that same IP. If you try it, an error will occur.