Advertisement

04.25.2008 at 03:57PM PDT, ID: 23355168 | Points: 500
[x]
Attachment Details

Wireshark - How to detect duplicate IP addresses?

Zones: System Diagnostic Software, Networking Hardware, Network Security
Is there a setting in wireshark that will allow me to detect duplicate IP addresses?
Start your free trial to view this solution
Question Stats
Zone: Software
Question Asked By: Matrix1000
Question Asked On: 04.25.2008
Participating Experts: 4
Points: 500
Views: 0
Translate:
Loading Advertisement...
04.25.2008 at 04:13PM PDT, ID: 21443796
paulop1975:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.25.2008 at 05:08PM PDT, ID: 21443954
Matrix1000:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.25.2008 at 05:38PM PDT, ID: 21444023
paulop1975:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.26.2008 at 07:57AM PDT, ID: 21445715
donmanrobb:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 06:51AM PDT, ID: 21453944

Rank: Master

DevilWAH:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 06:54AM PDT, ID: 21453974

Rank: Master

DevilWAH:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 09:43AM PDT, ID: 21455504
ahoffmann:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 10:58AM PDT, ID: 21456063
donmanrobb:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 11:28AM PDT, ID: 21456361
ahoffmann:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.28.2008 at 11:32AM PDT, ID: 21456409
donmanrobb:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.29.2008 at 12:57AM PDT, ID: 21460310

Rank: Master

DevilWAH:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
04.29.2008 at 01:11AM PDT, ID: 21460364

Rank: Master

DevilWAH:

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
 
Loading Advertisement...
Microsoft
  • Internet Protocols
  • Applications
  • Development
  • OS
  • Hardware
  • Windows Security
Apple
  • Operating Systems
  • Hardware
  • Programming
  • Networking
  • Software
Internet
  • Search Engines
  • File Sharing
  • WebTrends / Stats
  • Spy / Ad Blockers
  • Web Browsers
  • New Net Users
  • Web Development
  • Chat / IM
  • Anti Spam
  • Web Servers
  • Anti-Virus
  • Email Clients
Gamers
  • Tips
  • Online / MMORPG
  • Puzzle
  • Emulators
  • Action / Adventure
  • Role Playing
  • Consoles
  • Game Programming
  • Strategy
  • Sports
  • Misc
  • Computer Games
Digital Living
  • Hardware
  • New Net Users
  • New Users
  • Software
  • Digital Music
  • Gaming World
  • Home Security
  • Apple
  • Networking Hardware
Virus & Spyware
  • Vulnerabilities
  • IDS
  • Encryption
  • Anti-Virus
  • Operating Systems Security
  • Software Firewalls
  • WebApplications
  • Cell Phones
  • Operating Systems
  • Internet
  • Hardware Firewalls
Hardware
  • Handhelds / PDAs
  • Displays / Monitors
  • Components
  • Networking Hardware
  • Peripherals
  • Laptops/Notebooks
  • Storage
  • Servers
  • Desktops
  • New Users
  • Misc
  • Apple
Software
  • System Utilities
  • Industry Specific
  • Network Management
  • Photos / Graphics
  • Page Layout
  • VMWare
  • Misc
  • Web Development
  • OS
  • CYGWIN
  • Voice Recognition
  • Message Queue
  • Quality Assurance
  • Security
  • Firewalls
  • MultiMedia Applications
  • Development
  • Database
  • Office / Productivity
  • Business Management
  • OS/2 Apps
  • Server Software
  • Internet / Email
ITPro
  • OS
  • Storage
  • Encryption
  • Operating Systems Security
  • Apple Hardware
  • Laptops & Notebooks
  • Servers
  • Networking Hardware
  • Peripherals
  • Devices
  • Displays / Monitors
  • WebTrends / Stats
  • Search Engines
  • Firewalls
  • WebApplications
  • IDS
  • Vulnerabilities
  • Email Clients
  • File Sharing
  • Spy / Ad Blockers
  • Web Browsers
  • Web Servers
  • Networking
  • Anti-Virus
  • Chat / IM
  • Anti Spam
Developer
  • Web Servers
  • Web Browsers
  • Game Programming
  • Dev Tools
  • Industry Specific
  • Office / Productivity
  • Database
  • CYGWIN
  • Web Development
  • Search Engines
  • File Sharing
  • WebTrends / Stats
  • Programming
  • Content Management
  • Application Servers
  • Protocols
Storage
  • Removable Backup Media
  • Storage Technology
  • Servers
  • Grid
  • Remote Access
  • Backup / Restore
  • Misc
  • Hard Drives
OS
  • Miscellaneous
  • Security
  • Development
  • Linux
  • VMWare
  • MainFrame OS
  • Unix
  • Apple
  • OS / 2
  • AS / 400
  • BeOS
  • Microsoft
  • VMS / OpenVMS
Database
  • Oracle
  • Miscellaneous
  • MySQL
  • Software
  • Sybase
  • Contact Management
  • PostgreSQL
  • Data Manipulation
  • Clarion
  • InterSystems Cache
  • Siebel
  • MUMPS
  • OLAP
  • SQLBase
  • SAS
  • GIS & GPS
  • 4GL
  • Berkeley DB
  • DB2
  • Informix
  • Interbase / Firebird
  • FoxPro
  • Reporting
  • LDAP
  • Filemaker Pro
  • MS SQL Server
  • dBase
  • MS Access
Security
  • Misc
  • Web Browsers
  • Software Firewalls
  • Operating Systems Security
  • File Sharing
  • Spy / Ad Blockers
  • Vulnerabilities
  • WebApplications
  • IDS
  • Anti-Virus
  • Encryption
  • Anti Spam
  • Email Clients
  • VPN
  • Chat / IM
Programming
  • Editors IDEs
  • Installation
  • Handhelds / PDAs
  • Multimedia Programming
  • System / Kernel
  • Algorithms
  • Game
  • Signal Processing
  • Project Management
  • Open Source
  • Database
  • Misc
  • Languages
  • Processor Platforms
  • Theory
Web Development
  • Scripting
  • Blogs
  • Web Servers
  • Software
  • Search Engines
  • Web Graphics
  • Images
  • Internet Marketing
  • Images and Photos
  • Components
  • Document Imaging
  • Web Languages/Standards
  • Illustration
  • WebApplications
  • Fonts
  • WebTrends / Stats
  • Authoring
  • Digital Camera Software
  • Miscellaneous
Networking
  • Protocols
  • Apple Networking
  • Network Management
  • Message Queue
  • Application Servers
  • Content Management
  • File Servers
  • Email Servers
  • Misc
  • Java Editors & IDEs
  • Wireless
  • Networking Hardware
  • Backup / Restore
  • System Utilities
  • ISPs & Hosting
  • Web Servers
  • Storage Technology
  • Removable Backup Media
  • Servers
  • Broadband
  • Grid
  • OS / 2
  • Novell Netware
  • Unix Networking
  • Windows Networking
  • Security
  • Telecommunications
  • Operating Systems
  • Linux Networking
Other
  • Community Advisor
  • Lounge
  • Community Support
  • New Net Users
  • Philosophy / Religion
  • Math / Science
  • Miscellaneous
  • URLs
  • Expert Lounge
  • Politics
  • Puzzles / Riddles
Community Support
  • Suggestions
  • New to EE
  • New Topics
  • Community Advisor
  • CleanUp
  • Announcements
  • General
  • Feedback
  • Input
  • EE Bugs
 
04.25.2008 at 04:13PM PDT, ID: 21443796
paulop1975:
When you say "duplicate IP addresses", do you mean two machines with the same IP address? That is just not possible. If two computers are supposed to be on the same network in the same IP range, and even if they are manually configured, as soon as one of the machine is set for IP 192.168.2.10, no other machine can be set to that same IP. If you try it, an error will occur.
 
04.25.2008 at 05:08PM PDT, ID: 21443954
Matrix1000:
Yes,  two machines with the same IP address on the same network. It is possible, thats why I want detect it. It causes problems. I'm trying to figure out if Wireshark has a setting that marks/highlighs/detects duplicate IP addresses by comparing the IP address in a capture to the MAC addresses and detecting when two MAC addresses are related to the same IP address.
 
04.25.2008 at 05:38PM PDT, ID: 21444023
paulop1975:
Well, what may happen when two IPs are set the same on different machines, is both getting disconneted due to IP "colision" (?!). I can accept that, of course.
:)
Well... The only way I found to know of a duplicate IP is to look in the Event Viewer. If you had any linux machine, you could use the "arping -D" command: http://linux.about.com/library/cmd/blcmdl8_arping.htm
 
04.26.2008 at 07:57AM PDT, ID: 21445715
donmanrobb:
You can use the arp.duplicate-address-detected filter to track down duplicate addresses if memory serves
 
04.28.2008 at 06:51AM PDT, ID: 21453944

Rank: Master

DevilWAH:
yes you ca have two pcs with the same ip on the same network..

(at least you can set them to have them.. it wont work of course, but there is nothing physicaly stopping you do it!)

I not sure about Wireshark. have a look on there site.. i bet some one has created a filter/script to detect them some where!

however I use observer (wire shark on sterioids) to do network captures and this does indeed flag up duplicate addresses.

 
04.28.2008 at 06:54AM PDT, ID: 21453974

Rank: Master

DevilWAH:
rember some network teaming/ load balancing and hot spare routers my all display mulitply MAc address aginst a single IP address.

So in some cases duplicate IP address are not a problem. The actuly are part of a network.
 
04.28.2008 at 09:43AM PDT, ID: 21455504
ahoffmann:
you don't need wireshark, simply do continuously a
  arp -a|grep your-duplicate-IP-here

until you detect a change in the MAC
 
04.28.2008 at 10:58AM PDT, ID: 21456063
donmanrobb:
Matrix1000 did the filter I gave you work for you?

ahoffman, that would work but Matrix1000 didn't give any indication that he was using linux
 
04.28.2008 at 11:28AM PDT, ID: 21456361
ahoffmann:
arp is not only linux, it's any unix too, IIRC vms, and even windoze ;-)
 
04.28.2008 at 11:32AM PDT, ID: 21456409
donmanrobb:
True enough ARP is part of any OS, but the particular syntax you posted will not work for windows
 
04.29.2008 at 12:57AM PDT, ID: 21460310

Rank: Master

DevilWAH:
also it would depend on you being sure of what is the duplicated IP address.

If you are not sure or suspect you have several it could become a pain serching for them.

rember also the NIC you are serching with will need to be in the same subnet as the duplicated IP address.

Accross routers all remote ip addresses will have the mac address of the default gate way!!

so make sure you are testing the link for the correct place.

I( cant get that filter to work correctly Donmanrobb. It is some thing like that though?? however you could jsut do a capture of ARP traffic (only need replies). and then the packets by IP address. If any of the ip address have mnore than one mac address returned...




 
04.29.2008 at 01:11AM PDT, ID: 21460364

Rank: Master

DevilWAH:
yes also rember that although the ARP request it a broadcast.. the responce is directed to the requesting station.

So you will not be able to ditect a duplicated ip address from a single workstaion unless..

you either know what the ip address is that is duplicated..

or you run an arp on ever IP on the network from that PC and clean out your cache inbetween each one and repet untill you see the mac change..

or else mirror a core turnking link on a switch and monitor the ARP requests on that link..
 
 
20080236-EE-VQP-29 / EE_QW_2_20070628