Ip address conflict

[Ninad_1]

Hello Folks,
We have an ES40 server TRU 64 unix 4.0F. We are facing a problem related to ip address conflict for quite some time. what happens is that suppose any user in our lan configures his PC with the ip address same as that of our server our server gives error on the console and after that our server is not accessible from any PC on the Lan/Wan . then what we do is we remove the connection from the switch which goes to the hubs for users remove the ethernet connection from the server and restore it back and then again reconnect the switch connection for LAN. but this is not a permanent solution. The following few lines are from the /var/adm/messages file which shows the exact error message.

Feb 27 10:16:50 punetelecom1 vmunix: arp: local IP address 10.1.1.1 in use by ha
rdware address 00-D0-09-5F-62-DB
Feb 28 10:08:54 punetelecom1 vmunix: arp: local IP address 10.1.1.1 in use by ha
rdware address 00-40-05-73-6B-FB
Jul 3 17:05:35 punetelecom1 vmunix: arp: local IP address 10.1.1.1 in use by ha
rdware address 52-54-05-FF-EA-6E

Can anyone tell me what exactly is the problem with TRU64 that it disconnects the server from the LAN. Is this a bug or is there something in the configuration that has been missed.
what is the solution to this problem ?
Can anyone guide me.

Ninad Date

[Ralf Puchner]

The communication on lan is done by hardware addresses (MAC). Depending on your network the update of the arp cache leads to different entries and 10.1.1.1 is not the server anymore it is the pc using the same ip adress as the server. On the other side the switch may be protecting the network from duplicated ip addresses and switches of the ports of the machines involved.

Have a look into your switch configuration or change server ip address but duplicated ip addresses always leads to problems. I don't know why it is allowed in your net to configure a PC by their owners... think about profiles and protected administrator passwords.

[Ninad_1]

Our LAN is used for different applications and hence there is no restriction as such. And suppose someone wants to play mischief then also he can do the same. We tried the same thing for a NT server. We set the ip address of our win98 workstation to the same as that of our NT server ( while the ethernet cable of the workstation disconnected from hub ) after the ip address was configured we conencted the hub cable to the workstation but that did not give any problem with the NT server infact my workstation was out of the LAN. whereas when we tried the same thing by giving the unix server ip address it gave the same problem.

[Ralf Puchner]

Duplicate addresses leads to outage of connections and network.

Solution:
don't allow duplicated IP addresses!

Workaround:
shutdown PC and reconfigure your network adapter using ifconfig. This will broadcast your MAC/IP address again leading to flush of wrong MAC/IP assignment on clients.

[Ralf Puchner]

there are some differences in TCP/IP stack between Tru64 and NT. NT doesn't care about other network members this is fixed within W2K/XP/W2003.

And it depends what services are still running and if connections are open.

[Ninad_1]

Thanks Ralph for your replies.
I can see that there is no full proof solution to this problem and the only solution is to take care that ip addr are not duplicated. But this is fine if you are the only administrator for the LAN.

[Pieter 't Hart]

i think there IS a fullproof solution
assign your server a different ip-adres in a different subnet and place your servers (physically) behind a router so you are in control of systems connecting to this subnet.

Pieter

[Ralf Puchner]

The easiest way is to configure a dhcp server and allow automatic ip assignment.

Using a manageable switch allows to block important ip adresses from other ports except the server itself. This is the best way to block unauthorized ip usage.

Routers are the best way to control ip assignment but this is only possible if the office can be splitted up into different network ranges.

BTW. Lab operations should be seperated from the company network to prevent sideeffects to normal operations and servers.

[Ralf Puchner]

If your switch allows "security" features switch it on. This will prevents someone to plug in unauthorized network devices. The device will only work if the mac-address is enabled on the port - and so you have control if a correct IP address will be used.