Solved

Tracking down duplicate IP

Posted on 2004-09-14
21
465 Views
Last Modified: 2008-01-16
Ok, my boss has an IP address conflict message on her PC.  We run pure DHCP, but one of the other tech's must of assigned a static IP to another machine. It just happened to match her IP.  Is there anyway to find out where this IP is?  It wouldnt show up in a scan of the network since 2 IPs cant be active at the same time, right?
Thanks
0
Comment
Question by:dissolved
  • 5
  • 4
  • 2
  • +8
21 Comments
 
LVL 34

Accepted Solution

by:
PsiCop earned 300 total points
Comment Utility
Well, yes, it will, since if it wasn't active when her machine got its address, her machine wouldn't have any problems.

You can ping for it, but all that will tell you is that its running.

What you need to do is go the the router for the subnet and look at its ARP table and determine the MAC address for the workstation with that IP address. Then use your switch management tool to locate the switch to which that MAC address is connected, and hopefully the port as well.

Then you trace the wire back to the workstation.
0
 
LVL 2

Expert Comment

by:kinveachy
Comment Utility
Take a quick look at the DHCP server too.  You might notice two machines listed on there with the same conflicting IP.

You could always refresh your IP with the DHCP server and obtain another 'free' IP to immediately solve the problemo....
0
 

Assisted Solution

by:trey84
trey84 earned 125 total points
Comment Utility
you can use nbtstat -A which gives the remote machines name given its IP address
0
 
LVL 8

Assisted Solution

by:MarkDozier
MarkDozier earned 25 total points
Comment Utility
Use Look@Lan. It should give you what you are needing.
0
 
LVL 3

Expert Comment

by:iwontleaveyou
Comment Utility
just do one thing dont start your BOSS's machine and do a ping with -a switch to the conflicting IP address it will return u the name of that machine, when u have the machine name then u can easily track that machine.
then chnage the ip of that machine and then start your boss's machine.Thwere will be no conflict.

The command will be
ping -a x.x.x.x

if this does not returns u the name of the machine then have a look at the DNS entries here you might see two entries with same IP address, one will be your boss's machine and other will be the conflicting one from here also u can find the name of that machine.


0
 
LVL 23

Expert Comment

by:DanCh99
Comment Utility
if you turn off the machine that shows the duplicate, you can map to the c: drive of the other one.  Look there at the Documents and Settings folders, and the one with the most recent timestamp will be the last user that logged in
0
 
LVL 9

Assisted Solution

by:binary_1001010
binary_1001010 earned 25 total points
Comment Utility
Like what trey84 said, do a

nbtstat -A ipaddress , for example the conflicting ip addess is 192.168.1.5, then do a

nbtstat -A 192.168.1.5 , then it will display the computer name that the ip is assigned to.

after u found the computer name, do a

nbtstat -a  computer name, then it will show you who is logon to the machine.

notes:  the syntax is case sensitive

-A  for ip addres
-a  for computer name
0
 
LVL 4

Assisted Solution

by:sloopeth
sloopeth earned 25 total points
Comment Utility
take your bosses machine off the network then from any machine do from dos

"NET SEND x.x.x.x COULD YOU PLEASE COME AND SEE THE IT DEPT ASAP PLS THANK YOU."

where x.x.x.x is the ip address in question

qed.

0
 
LVL 3

Expert Comment

by:hbbw063
Comment Utility
Shut down your boss machine.
Try to retrive the duplicate IP machine's MAC address and than locate its switch port using mac address table (I suppose you have a Cisco switch).
0
 

Author Comment

by:dissolved
Comment Utility
the nbtstat -A ip_address command only displays info about my boss's computer.
Doesnt show anything else.


I went into the DHCP server and viewed leased addresses.  My boss's IP is not showing up in there (even though she obtained her IP through DHCP).

I dont have access to the switch unfortunately.

Any other ideas?
Thanks for all the comments/suggestions fellas.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 8

Expert Comment

by:holger12345
Comment Utility
If u use "arp -a" u get something like
______________________________________________
C:\>arp -a
Schnittstelle: 10.1.1.11 --- 0x10003
  Internetadresse       Physikal. Adresse     Typ
  10.1.1.1              00-c0-7b-xx-xx-xx     dynamisch
  10.1.1.4              00-48-54-yy-yy-yy     dynamisch
______________________________________________

1) If the persons PC is only connected through a switch, you'll find the IP with the corresponding MAC-adress
2) If the persons PC is behind a routers port, you'll see that IP with the same MAC-address as the router has (thats because of the layer-2 protocol, don't mind!)

In the first case, you should notify the MAC and hunt down that PC
My example shows my router at 10.1.1.1 but my PCs and the router are connected just using a switch

Another thing is:
C:\>net view
Servername             Beschreibung
-------------------------------------------------
\\DEVIL                Celly 400
\\PHOENIX              P4 - 2,6GHz - MyALDIPC
Der Befehl wurde erfolgreich ausgeführt.

If you now use a ping to the names, you have their IPs... and you can  hopefully identify them

C:\>ping devil
Ping devil [10.1.1.4] mit 32 Bytes Daten:
Antwort von 10.1.1.4: Bytes=32 Zeit<1ms TTL=128

regards
Holger
0
 

Assisted Solution

by:trey84
trey84 earned 125 total points
Comment Utility
What happens when you ipconfig /release   then ipconfig /renew on your boss's machine?

Is it a laptop?
0
 

Author Comment

by:dissolved
Comment Utility
yea its a laptop, but she never takes it home. Going to reboot her machine when she isnt busy to see if it gets another IP
0
 
LVL 34

Expert Comment

by:PsiCop
Comment Utility
SHouldn't need to reboot - ipconfig /release followed by ipconfig /renew should do fine. Reboot will not necessarily cause it to ask for another IP address from DHCP.
0
 

Expert Comment

by:trey84
Comment Utility
Are you sure she didn't take it home or to a hotel?

Are using something common like 192.168.1.x?
0
 

Expert Comment

by:trey84
Comment Utility
laptops really need to have a .bat file on the desktop to make it easy to ipconfig /release ipconfig /renew
0
 

Author Comment

by:dissolved
Comment Utility
thanks for the advice everyone.  Still have not found the person using her IP. Since I dont have access to the switch, I probably never will either!
Oh well .  

Would there be a way in the switch, to configure it so it only allows one MAC mapping to an IP address? Or do you need a layer3 switch for something like that?
0
 

Expert Comment

by:trey84
Comment Utility
Did you renew her IP?  Is their another device giving out IP addresses?  Did you try Ipconfig?

What's the deal?

0
 
LVL 3

Expert Comment

by:iwontleaveyou
Comment Utility
It seems that you haven't tried my suggestion.
Give it a try and your all problems will go.

Just do one thing. When you come in the morning just dont start your BOSS machine. Just make a ping with -a command and the conflicting IP address.

since this time ur boss machine is off so there will be no IP conflict and you can easily ping that IP with -a switch you will get the machines name. then u can easily know which machine is it.

the command must be:

ping -a x.x.x.x

where x.x.x.x is the conflicting ip like 192.168.0.2 or somewhat like that.

give it a try and let me know what results u get.
0
 
LVL 4

Expert Comment

by:sloopeth
Comment Utility
he clearly hasnt tried mine either :p
0
 

Author Comment

by:dissolved
Comment Utility
I have tried your suggestions. ping -a only returns the boss's machine.  I also did do a net send to no avail. My boss was the only one that saw it. I'm going to try to get into the switch.
Thanks for everyones suggestions.
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Some time ago I was asked to set up a web portal PC to put at our entrance. When customers arrive, they could see a webpage 'promoting' our company. So I tried to set up a windows 7 PC as a kiosk PC.......... I will spare you all the annoyances I…
Let’s list some of the technologies that enable smooth teleworking. 
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now