IP Address Conflict 1

[Airforce1]

I have a new client who uses all static IP addresses. I have gone to every device on the network, i.e., managed switches, PCs, Servers, routers, etc. and I have documented the IP addresses in use. My problem is there are several IP addresses that do not appear to be in use, but when I try to assign them to a PC, the address is in conflict with some other device on the network. I have never run into this before. How can this be?

 

[jimbopalmer]

I use a IP scanner to find devices I did not know existed

http://www.angryziber.com/ipscan/

I tried to remain child-like, all I acheived was childish.

 

[jimbopalmer]

Another trick is to go to the IP address as a web page, often printers and network gear has a web page, even my UPS has a web page

I tried to remain child-like, all I acheived was childish.

 

[pkirpalani]

try Ping -a this should give you the name of the device

 

[Airforce1]

I have used an IP Scanner and it returns "dead" for the IP addresses in question,i.e., when I try to assign those same IP address to a Windows XP machine, the PCs indicate an IP address conflict with the supposed "dead" addresses.

 

[skullyman]

Download Etherreal, it will give you the MAC and you should be able to track it down based on MAC for each IP.

 

[phannah]

You can also check your ARP table for the IP address in question, and with this, look up the vendor based on the MAC address.

arp - a will print the table, you can look up the OUI here:

http://standards.ieee.org/regauth/oui/index.shtml

 

[mrbspc]

Just because a device doesn't respond to an ICMP request,
does not mean it is non-existant. Could be a firewall, or
an XP machine with firewall software that doesn't respond
to pings. If you have manually checked all devices commonly
though of, I would start looking at network printers and
print servers and Wireless access points (I know I forget
them from time to time). A lot of new copy machines can scan
PDF's to email. That takes an IP also. Maybe a machine with
virtual IP address?? or a security camera system that runs
over IP. It has to be something you're missing. I haven't
ever seen an IP conflict that was a false
positive.

The arp message above is the best way to narrow it down
assuming the IP in question is even in the arp table.

Hope this helps,
B

 

[jeroenw1]

Could it be an (old) DHCP-reservation?