Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 344
  • Last Modified:

Ghost IP - How do I kill it?

I am configuring a pc with an Ip address on my lan which is running 2003 Server with Active Directory and every pc has the server set as the Primary DNS server.
When I configure the client machine with the ip in question, it says that the ip address is already in use on the network.
When I try to ping or port scan that address it doesn't respond and there are no ports open.
The only thing that I can think of is that its in an arp cache somewhere or something....

What can I do to clear it or find the offending machine?
0
Matrix1000
Asked:
Matrix1000
1 Solution
 
Tim HolmanCommented:
PING the IP address in question, then do an ARP -a to see if the MAC address is listed.
A successful PING response is not mandatory for an ARP cache fill.
Do this on each of your subnets.
If you can find the MAC address, you can probably look through your switch ARP caches to work out precisely where this machine is.
0
 
wileyaCommented:
i mistakenly gave the same IP address to two PCs
a PC that i was setting up in my MIS room and
a PC that was at the other end of the fiber optic

(the boss) got instantly knocked off the network
with an error message that said the IP address
was already in use,

and i couldn't ping that IP because i was pinging
that IP address from the PC that had that same IP
(sort of like calling my phone number from my phone
duh, somebody on it, yea me)

that's one of the problems with static IP addresses
versus dynamic addressing
0
 
Matrix1000Author Commented:
Thanks for the reply,,,,I'm  pinging from another machine just to be safe...
I did an Arp -a on the server and it comes up with the IP and Mac address....Now that I have the offending mac address ( I think) how can I ping /get the hostname/ find the offending computer?
0
NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

 
netspec01Commented:
Try ping -A 1.2.3.4
0
 
vnicolaeCommented:
The problem comes with the WINS. Go into it and delete the entry for that IP address. You should be ok after that.


Vlad
0
 
Tim HolmanCommented:
ping -a 1.2.3.4, not -A  ;)

You can also look the MAC address up for it's vendor code on something like this:

http://www.erg.abdn.ac.uk/users/gorry/course/lan-pages/mac-vendor-codes.html

This will narrow your search down to NIC vendor, which may be useful ?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now