asked on

Tracking down duplicate IP

Ok, my boss has an IP address conflict message on her PC. We run pure DHCP, but one of the other tech's must of assigned a static IP to another machine. It just happened to match her IP. Is there anyway to find out where this IP is? It wouldnt show up in a scan of the network since 2 IPs cant be active at the same time, right?
Thanks

ASKER CERTIFIED SOLUTION

PsiCop

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

kinveachy

Take a quick look at the DHCP server too. You might notice two machines listed on there with the same conflicting IP.

You could always refresh your IP with the DHCP server and obtain another 'free' IP to immediately solve the problemo....

SOLUTION

trey84

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

MarkDozier

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

iwontleaveyou

just do one thing dont start your BOSS's machine and do a ping with -a switch to the conflicting IP address it will return u the name of that machine, when u have the machine name then u can easily track that machine.
then chnage the ip of that machine and then start your boss's machine.Thwere will be no conflict.

The command will be
ping -a x.x.x.x

if this does not returns u the name of the machine then have a look at the DNS entries here you might see two entries with same IP address, one will be your boss's machine and other will be the conflicting one from here also u can find the name of that machine.

Danny Child

if you turn off the machine that shows the duplicate, you can map to the c: drive of the other one. Look there at the Documents and Settings folders, and the one with the most recent timestamp will be the last user that logged in

SOLUTION

binary_1001010

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

sloopeth

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

hbbw063

Shut down your boss machine.
Try to retrive the duplicate IP machine's MAC address and than locate its switch port using mac address table (I suppose you have a Cisco switch).

dissolved

ASKER

the nbtstat -A ip_address command only displays info about my boss's computer.
Doesnt show anything else.

I went into the DHCP server and viewed leased addresses. My boss's IP is not showing up in there (even though she obtained her IP through DHCP).

I dont have access to the switch unfortunately.

Any other ideas?
Thanks for all the comments/suggestions fellas.

holger12345

If u use "arp -a" u get something like
______________________________________________
C:\>arp -a
Schnittstelle: 10.1.1.11 --- 0x10003
Internetadresse Physikal. Adresse Typ
10.1.1.1 00-c0-7b-xx-xx-xx dynamisch
10.1.1.4 00-48-54-yy-yy-yy dynamisch
______________________________________________

1) If the persons PC is only connected through a switch, you'll find the IP with the corresponding MAC-adress
2) If the persons PC is behind a routers port, you'll see that IP with the same MAC-address as the router has (thats because of the layer-2 protocol, don't mind!)

In the first case, you should notify the MAC and hunt down that PC
My example shows my router at 10.1.1.1 but my PCs and the router are connected just using a switch

Another thing is:
C:\>net view
Servername Beschreibung
-------------------------------------------------
\\DEVIL Celly 400
\\PHOENIX P4 - 2,6GHz - MyALDIPC
Der Befehl wurde erfolgreich ausgeführt.

If you now use a ping to the names, you have their IPs... and you can hopefully identify them

C:\>ping devil
Ping devil [10.1.1.4] mit 32 Bytes Daten:
Antwort von 10.1.1.4: Bytes=32 Zeit<1ms TTL=128

regards
Holger

SOLUTION

trey84

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

dissolved

ASKER

yea its a laptop, but she never takes it home. Going to reboot her machine when she isnt busy to see if it gets another IP

PsiCop

SHouldn't need to reboot - ipconfig /release followed by ipconfig /renew should do fine. Reboot will not necessarily cause it to ask for another IP address from DHCP.

trey84

Are you sure she didn't take it home or to a hotel?

Are using something common like 192.168.1.x?

trey84

laptops really need to have a .bat file on the desktop to make it easy to ipconfig /release ipconfig /renew

dissolved

ASKER

thanks for the advice everyone. Still have not found the person using her IP. Since I dont have access to the switch, I probably never will either!
Oh well .

Would there be a way in the switch, to configure it so it only allows one MAC mapping to an IP address? Or do you need a layer3 switch for something like that?

trey84

Did you renew her IP? Is their another device giving out IP addresses? Did you try Ipconfig?

What's the deal?

iwontleaveyou

It seems that you haven't tried my suggestion.
Give it a try and your all problems will go.

Just do one thing. When you come in the morning just dont start your BOSS machine. Just make a ping with -a command and the conflicting IP address.

since this time ur boss machine is off so there will be no IP conflict and you can easily ping that IP with -a switch you will get the machines name. then u can easily know which machine is it.

the command must be:

ping -a x.x.x.x

where x.x.x.x is the conflicting ip like 192.168.0.2 or somewhat like that.

give it a try and let me know what results u get.

sloopeth

he clearly hasnt tried mine either :p

dissolved

ASKER

I have tried your suggestions. ping -a only returns the boss's machine. I also did do a net send to no avail. My boss was the only one that saw it. I'm going to try to get into the switch.
Thanks for everyones suggestions.