how to detect IP-address clashes ?

[Banibrata Dutta]

Hi,

Are there some hp-ux network troubleshooting utilities (hopefully supplied by default), that can help in detecting IP-address clashes ?

thanks,
bd

[RAC_1]

I do not know any tools that do this. One thing that I can think of is noting server mac address (ping/telent etc) and checking it at regular intervals. If mac changes, you can say that some problem is there.

[Adisuria Wangsadinata_1]

Hi BD,

The traditional tools is by using 'ping' & 'nslookup' commands to check whether the IP already used by other device or not.

# ping XX.YY.ZZ.WW -n 5
# nslookup XX.YY.ZZ.WW

If ping output with 100% packet loss, means there's no device responding for this command.

And nslookup output will show not a hostname, this will confirmed for no device using the IP.

The other utilities is by using HP OpenView NNM, but this one is not a free-ware.

Hope this information can help.

Cheers,
AW

[Banibrata Dutta]

Hi Adisuria,

I think my issue is having 2 hosts really having "assigned" the same IP and trying to use them at the same time. I am not really sure, how doing a "nslookup" would be of any help. "nslookup" would query the DNS and tell me the IP of the legitimate host. The problem is that an illegitimate host is sqatting on the IP.

- bd

[Peter Godron]

Hi,
can you please have a look at:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=279986
also
man arp and man 7p arp

[Victor BERRIDGE]

Hi,
I suppose its time to do a man of nettl...


All the best
Victor

[melvyn burnard]

looking at your arp cache may help here
man arp

[Steven E. Protter]

Shalom

arp

arp -d to get rid of the duplicate. If it comes back immediately you have a problem workstation or DHCP server.

SEP
Offline most of the day RHCE Exam.

[Victor BERRIDGE]

Hi again...
Once youve stoped /usr/sbin/nettl
you can format the file generated:
netfmt -f /var/adm/nettl.LOG000|more

This is what I do when chasing after duplicates...

All the best
Victor

[Banibrata Dutta]

Hello Victor,

Thanks for the followup. I am familiar with nettl & netfmt, but I wasn't really sure what to do with the network traces ! What to really watch-out for ?

Can you elaborate, what do you really chase?

thanks,
bd

[Victor BERRIDGE]

Hi,
I had to look for old logs to find something...
In 2002 I had trouble with a server, this sort of messages could be found:
1 18:49:52 182571128 1 T.. 0 0 IP: Hardware address '00:30:6e:09:d1:86' trying to be our
address XXX.YYY.109.113!

...
All the best
Victor

[Kevin Wright]

could be messages in syslog.. disconnect the cable you feel may be clashing.. from another box, kick off a ping. Tracking it down without updated IP documentation could be a challenge.

[Bill Hassell]

Duplicate IP addresses are common in an environment where users are allowed to 'play' with their systems -- one of the best reasons never to allow Windows users to have administrator logins. nettl and the formatter are a pain to use so you might get a copy of Ethereal to watch the traffic. The real problem is that network traces are only useful once the problem exists.

Now the arp -a command should help since it reports the MAC address, but this assumes that you have smart routers and switches that can be queried to find the MAC address of the culprit. That will atleast get you to the port which you can then disable. In an ideal world, every cable on ebery switch will have a location recorded.

[Thomas J. Harrold]

nettl should be running by default. It will point out duplicate addresses, I believe.

View the logs with:

netfmt -t 50 /var/adm/nettl.LOG000 | more


This will display the most recent 50 messages.

-tjh