Solved

Ghost IP - How do I kill it?

Posted on 2004-10-01
6
259 Views
Last Modified: 2008-03-06
I am configuring a pc with an Ip address on my lan which is running 2003 Server with Active Directory and every pc has the server set as the Primary DNS server.
When I configure the client machine with the ip in question, it says that the ip address is already in use on the network.
When I try to ping or port scan that address it doesn't respond and there are no ports open.
The only thing that I can think of is that its in an arp cache somewhere or something....

What can I do to clear it or find the offending machine?
0
Comment
Question by:Matrix1000
6 Comments
 
LVL 23

Expert Comment

by:Tim Holman
ID: 12202615
PING the IP address in question, then do an ARP -a to see if the MAC address is listed.
A successful PING response is not mandatory for an ARP cache fill.
Do this on each of your subnets.
If you can find the MAC address, you can probably look through your switch ARP caches to work out precisely where this machine is.
0
 
LVL 4

Expert Comment

by:wileya
ID: 12202674
i mistakenly gave the same IP address to two PCs
a PC that i was setting up in my MIS room and
a PC that was at the other end of the fiber optic

(the boss) got instantly knocked off the network
with an error message that said the IP address
was already in use,

and i couldn't ping that IP because i was pinging
that IP address from the PC that had that same IP
(sort of like calling my phone number from my phone
duh, somebody on it, yea me)

that's one of the problems with static IP addresses
versus dynamic addressing
0
 
LVL 1

Author Comment

by:Matrix1000
ID: 12202918
Thanks for the reply,,,,I'm  pinging from another machine just to be safe...
I did an Arp -a on the server and it comes up with the IP and Mac address....Now that I have the offending mac address ( I think) how can I ping /get the hostname/ find the offending computer?
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 5

Expert Comment

by:netspec01
ID: 12203043
Try ping -A 1.2.3.4
0
 
LVL 4

Expert Comment

by:vnicolae
ID: 12203581
The problem comes with the WINS. Go into it and delete the entry for that IP address. You should be ok after that.


Vlad
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
ID: 12206575
ping -a 1.2.3.4, not -A  ;)

You can also look the MAC address up for it's vendor code on something like this:

http://www.erg.abdn.ac.uk/users/gorry/course/lan-pages/mac-vendor-codes.html

This will narrow your search down to NIC vendor, which may be useful ?
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

There have been a lot of times when we have seen the need to enter a large number of DNS entries in a forward lookup zone. The standard procedure would be to launch the DNS Manager console, create the Zone and start adding new hosts using the New…
Occasionally you run into the website or two that will not resolve properly using your own DNS servers.  Some people simply set up global forwarders for their DNS server.  I don’t recommend doing this because it can cause problems resolving addresse…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now