Locating a IP Conflict

[TheJuiceman]

Hey guys,

I have something on my network that is having an IP conflict with an XP box in our office. Not only is the device sharing IP addresses, it is sharing hosts names as well. The unit shows up in the ARP table on our HP machine with our hostname and IP, but with a different MAC. Pinging the device shows that it is going up and down several times a day. Is there a good way to track this down?
PS - We are on a NetWare 5.1 network.

[Steven E. Protter · Accepted solution]

Your best bet is to temporarily change the ip address of the hp box.

then ping the broadcast address and make sure the XP box it there.

Then run a traceroute and identify the branch or leg of your network the machine is on.

There is a tool called ethereal that will allow you to track whats going on on the workstation and even possibly figure out where it is.

http://hpux.connect.org.uk/hppd/hpux/Gtk/Applications/ethereal-0.9.15/

This tool will probably let you filter by ip address or mac address to help you pinpoint whats going on.

Hope this is a start.

SEP

[PVR]

We can locate IP conflict and other network related errors in an HP UX environment by examining the file /var/adm/nettl.LOG000

#netfmt -Nvf /var/adm/nettl.LOG000

[Elmar P. Kolkman]

The fact that it shows up in the arp table with the same hostname, has nothing to do with the hostname on the XP box, but with the fact that your ARP table consists of IP addresses and MAC addresses and that for the readers sake those IP addresses are translated to hostnames using DNS (or your hosts file or NIS).

To locate the XP box, you could use unix tools, or you could try to search for the offending MAC address. In our environment, we have managed switches and routers that can be searched which MAC address is connected to which port.

If you don't have these, it might be harder. But you might try to use things like remote assistant or other XP tools to find out which XP box it is. For instance, start browsing the shared devices on IP address when the XP box is up. Mind: you need to disable the IP address for the time being to be able to use those tools...