Tracking down duplicate IP

Ok, my boss has an IP address conflict message on her PC.  We run pure DHCP, but one of the other tech's must of assigned a static IP to another machine. It just happened to match her IP.  Is there anyway to find out where this IP is?  It wouldnt show up in a scan of the network since 2 IPs cant be active at the same time, right?
Who is Participating?
PsiCopConnect With a Mentor Commented:
Well, yes, it will, since if it wasn't active when her machine got its address, her machine wouldn't have any problems.

You can ping for it, but all that will tell you is that its running.

What you need to do is go the the router for the subnet and look at its ARP table and determine the MAC address for the workstation with that IP address. Then use your switch management tool to locate the switch to which that MAC address is connected, and hopefully the port as well.

Then you trace the wire back to the workstation.
Take a quick look at the DHCP server too.  You might notice two machines listed on there with the same conflicting IP.

You could always refresh your IP with the DHCP server and obtain another 'free' IP to immediately solve the problemo....
trey84Connect With a Mentor Commented:
you can use nbtstat -A which gives the remote machines name given its IP address
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

MarkDozierConnect With a Mentor Commented:
Use Look@Lan. It should give you what you are needing.
just do one thing dont start your BOSS's machine and do a ping with -a switch to the conflicting IP address it will return u the name of that machine, when u have the machine name then u can easily track that machine.
then chnage the ip of that machine and then start your boss's machine.Thwere will be no conflict.

The command will be
ping -a x.x.x.x

if this does not returns u the name of the machine then have a look at the DNS entries here you might see two entries with same IP address, one will be your boss's machine and other will be the conflicting one from here also u can find the name of that machine.

Danny ChildIT ManagerCommented:
if you turn off the machine that shows the duplicate, you can map to the c: drive of the other one.  Look there at the Documents and Settings folders, and the one with the most recent timestamp will be the last user that logged in
binary_1001010Connect With a Mentor Commented:
Like what trey84 said, do a

nbtstat -A ipaddress , for example the conflicting ip addess is, then do a

nbtstat -A , then it will display the computer name that the ip is assigned to.

after u found the computer name, do a

nbtstat -a  computer name, then it will show you who is logon to the machine.

notes:  the syntax is case sensitive

-A  for ip addres
-a  for computer name
sloopethConnect With a Mentor Commented:
take your bosses machine off the network then from any machine do from dos


where x.x.x.x is the ip address in question


Shut down your boss machine.
Try to retrive the duplicate IP machine's MAC address and than locate its switch port using mac address table (I suppose you have a Cisco switch).
dissolvedAuthor Commented:
the nbtstat -A ip_address command only displays info about my boss's computer.
Doesnt show anything else.

I went into the DHCP server and viewed leased addresses.  My boss's IP is not showing up in there (even though she obtained her IP through DHCP).

I dont have access to the switch unfortunately.

Any other ideas?
Thanks for all the comments/suggestions fellas.
If u use "arp -a" u get something like
C:\>arp -a
Schnittstelle: --- 0x10003
  Internetadresse       Physikal. Adresse     Typ              00-c0-7b-xx-xx-xx     dynamisch              00-48-54-yy-yy-yy     dynamisch

1) If the persons PC is only connected through a switch, you'll find the IP with the corresponding MAC-adress
2) If the persons PC is behind a routers port, you'll see that IP with the same MAC-address as the router has (thats because of the layer-2 protocol, don't mind!)

In the first case, you should notify the MAC and hunt down that PC
My example shows my router at but my PCs and the router are connected just using a switch

Another thing is:
C:\>net view
Servername             Beschreibung
\\DEVIL                Celly 400
\\PHOENIX              P4 - 2,6GHz - MyALDIPC
Der Befehl wurde erfolgreich ausgeführt.

If you now use a ping to the names, you have their IPs... and you can  hopefully identify them

C:\>ping devil
Ping devil [] mit 32 Bytes Daten:
Antwort von Bytes=32 Zeit<1ms TTL=128

trey84Connect With a Mentor Commented:
What happens when you ipconfig /release   then ipconfig /renew on your boss's machine?

Is it a laptop?
dissolvedAuthor Commented:
yea its a laptop, but she never takes it home. Going to reboot her machine when she isnt busy to see if it gets another IP
SHouldn't need to reboot - ipconfig /release followed by ipconfig /renew should do fine. Reboot will not necessarily cause it to ask for another IP address from DHCP.
Are you sure she didn't take it home or to a hotel?

Are using something common like 192.168.1.x?
laptops really need to have a .bat file on the desktop to make it easy to ipconfig /release ipconfig /renew
dissolvedAuthor Commented:
thanks for the advice everyone.  Still have not found the person using her IP. Since I dont have access to the switch, I probably never will either!
Oh well .  

Would there be a way in the switch, to configure it so it only allows one MAC mapping to an IP address? Or do you need a layer3 switch for something like that?
Did you renew her IP?  Is their another device giving out IP addresses?  Did you try Ipconfig?

What's the deal?

It seems that you haven't tried my suggestion.
Give it a try and your all problems will go.

Just do one thing. When you come in the morning just dont start your BOSS machine. Just make a ping with -a command and the conflicting IP address.

since this time ur boss machine is off so there will be no IP conflict and you can easily ping that IP with -a switch you will get the machines name. then u can easily know which machine is it.

the command must be:

ping -a x.x.x.x

where x.x.x.x is the conflicting ip like or somewhat like that.

give it a try and let me know what results u get.
he clearly hasnt tried mine either :p
dissolvedAuthor Commented:
I have tried your suggestions. ping -a only returns the boss's machine.  I also did do a net send to no avail. My boss was the only one that saw it. I'm going to try to get into the switch.
Thanks for everyones suggestions.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.