How do I find a duplicate IP address?

[JBruyet]

Hey all,

I know this sounds basic but I'm without any more ideas. I have a DC that frequently has an entry in the event log that says that it's detected a duplicate IP address on the network. I've done NBTSTAT -n and used NSLOOKUP on both the IP address and the NetBIOS name and everything I do just points to my DC. I even turned the DC off and tried to ping its address and its NetBIOS name. Nothing. Is there something else I can try to see if there truly is a second device "out there" with the same IP address??? Also, fwiw this address isn't in my scope of addresses in either of my DHCP servers.

Thanks,

Joe B

 

[Roadki11]

This can be tough to work out. How big is your network(number of devices, geography) how often does this happen? Ive seen people bring in a PDA or a WAP for the PDA or what not that have just enough knowledge to figure out how to put a network usable ip on them. Then once a week or twice a month they are in the office or bring in the device and play with it on the network to sync it with there outlook or just play on the net and bingo, duplicate ips. Ive also seen a printer configured with the same ip as a workstation. Seems that users would send a print job, it wouldnt print so they would power cycle the printer and hey cool the printer works but the guy on the other side of the building just got knocked off the the network, he dont know why so he reboots and great his pc works until they powercycle the printer again. Vicious circle. Anyway, not sure if this could be your problem but these are things you should investigate.

RoadKi11

 

[kmcferrin]

If it's showing up as a dupe then it would be in the same subnet. Shutting down the server and pinging the address should get a reply if the device is present. You said "nothing", does that mean you get no reply or you are unable to track down the device?

 

[soupman]

I can't remember if the Event viewer reports the conflicting IP address and MAC address. If you get the conflicting MAC addresses are, you can locate the problem PCs or devices if you have a Managed Layer 2 switch. Most Managed switches will show you the MAC tables which will then tell you what port they are connected to.

Be carefull because sometimes a MAC address may show on a port that is connected to another switch so the user may actually be connected to a cascaded switch. Hope this helps.

 

[JBruyet]

RoadKill:
My network runs about 100 devices--servers, workstations, switches, etc... I talked with my GM as he is the only one with a PDA that accesses the network directly and it uses DHCP to get its address. All printers are attached to workstations and are shared to facilitate installation on other workstations. I guess it's possible that there's a rogue device showing up, but since I'm running DHCP and the address that keeps popping up isn't in my DHCP scope I'm not sure that's the problem.

kmcferrin:
When I turned off the server and pinged the IP address all I saw were "Request timed out." messages. And the same with pinging the NetBIOS name.

soupman:
When I check the log I get a message that says... Hmmm... It's not a duplicate IP address, it's a duplicate name. I was just checking and here's the text of the message:

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4319
Date: 8/27/2007
Time: 8:36:19 AM
User: N/A
Computer: DC1
Description:
A duplicate name has been detected on the TCP network. The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 01 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 0b 02 a8 c0 ..¨À

So it's a duplicate name, not IP address. And I used to think that I was pretty sharp in this kinda stuff. OK, to continue, but in a different direction, How do I...

Sheesh, I think I just found the MAC address of the offending machine. Maybe I need to read my books again. If I run into another roadblock I'll come back. Actually, either way I'll come back.

Thanks all of you for your time!

Joe