Why do I get "duplicate IP address" on 17 different machines?

[Klick]

I'm on a segmented network, for brevity I'll call them .1 and .6 referring to the segments 192.168.1.x and 192.168.6.x

The .6 segment has a lot of broadcast traffic - considerably more than .1 - and it's slowing it down.

A couple of LAN analyzer software (demo) packages show "duplicate IP address" for several mac address (about 17 at last count). These are not actual duplicate IP addresses (determined by looking).

The "duplicate IP address" message provides both node addresses (mac addresses). Another symptom is that second address of the two reported to have the same IP is always the same mac address for all the different nodes.

Looks something like this:

Duplicate 192.168.6.145 from 00105A150EEC and 0030194DD680
Duplicate 192.168.6.172 from 0050DA729B3A and 0030194DD680
Duplicate 192.168.6.156 from 00105AE4A8AD and 0030194DD680
...

One hint was from a site that said one of the machines on the segment was using the other segment's router, but I've checked the network setting for all of these machines (no small task) and they're all correct.

All of the machines are running TCP/IP, IPX/SPX, and IPX 32 bit on mostly Win98 machines with 2 or 3 Win2000Pro machines.

I'm at a loss and any help is appreciated very much.

Thanks,
Kevin

 

[jimbopalmer]

00:30:19 is the mac address prefix of Cisco, so it is some piece of Cisco gear in your network.

http://coffer.com/mac_find/

I tried to remain child-like, all I acheived was childish.

 

[Klick]

Thank you for the considerate response. I've identified the problem and all of the components. I was trying to be brief so I didn't list those type of details. We know the Cisco router (identified by the mac address) is not causing this problem. I believe it to be an "echo" of a different problem. I guess my question at this point is "how do I stop the broadcast traffic"? Thank you again for your help.

Kevin

 

[browolf]

pardon me,

can i ask how come you are using tcp/ip and ipx.

does lan analyser do packet sniffing?
if not i suggest ethereal (

http://www.ethereal.com)

it might be useful to know where the duplicate ip errors are coming from and other strange things.

are u using wins / netbeui / wins over dhcp?

what servers are u using win32/netware ?

is your subnet mask 255.255.255.0 or 255.255.0.0?

just a few things that might help someone solve your problem. ===============
Security Forums

http://www.security-forums.com

 

[Klick]

This is an inherited network and I'm working on using just one protocol.

Yes, the LAN Analyzer softer does packet sniffing. It is only demo-ware though and due to expire soon so I'm really trying to sell the boss on it before it's expired.

Yes I have a WINS server setup on the .1 segment.

Yes, there are both NetWare and Win32 (NT4 & 2K) servers on the network.

The subnet mask is 255.255.255.0

Anyone have a clue about the broadcast duplicates?

 

[svermill]

It's possible that there is a bug of some sort on your router. I don't know what demo your using, but the aforementioned ethereal (

http://www.ethereal.com)

is free and is all I ever use. You need something that can get inside those duplicated packets. Find out what's in them. Routers can be enabled with proxy arp, where they pretend to be a remote host. In other words, I'm a router, I know how to get to host b on network b, and so I'll answer any arp requests from host a on network a. Obviously, a router shouldn't do that if a host is local and not in need of proxy arping. But bugs are quite common, unfortunately. And this is just one of many possibilities. I don't think you can safely say that it isn't the router until you've looked inside the packets.

 

[bwilliam13]

I think what you're seeing is something due to ARP or RARP proxying/caching.

When you use an ARP cache, an interface on a router or firewall may effectively *steal* the ip address until the cache expires.

Something similar happened on our PIX firewall a while back, and the solution was to turn Proxy ARP/RARP caching off. After that, we didn't get those duplicate IP address messages.