IP Conflict

[Leovino A. Trinidad, Jr]

Hi!

I want to ask how do you prevent a server from IP conflict? We just had this occured in one of our critical production linux server. Can we use IPTables for this?

Regards,


LAT

[Slawomir Gora]

Hi,

maby you can use arping.

[Vitaly Karasik_1]

IMHO, you cannot prevent IP conflicts without users educations/Network policy.
[User can boot his computer with random IP, start DHCP server, etc]

Regarding technical tools - probably you can play with switches configuration in order to connect MAC and IP.

[HGN]

Hi

This has happened many times on our environment, this can be prevented only by us by making sure that this ip does not exist elsewhere,nslookup can be used. Also talking to the network people who assign the IP for them to make sure that also don't assign duplicate IP's.

Rgds

Gopi

[Steven E. Protter]

IP conflict is not an environment in which democracy flourishes. You need a dictatorship.

There has to be one person who is anal and keeps good records and hands out IP addresses.

A lot of issues are resolved by setting up a DHCP pool for clients and requiring all users to use this model. Users should never be allowed to assign their own IP addresses.

Sysadmins MUST be required to go to the dictator to get server ip addresses.

In this environment there will be little conflict.

Point up these guys, they gave you nice input Sir.

SEP

[Leovino A. Trinidad, Jr]

Hello!

Thank you guys for your help and for sharing your ideas on how to prevent the conflict. I am just wondering, can it happen that the conflict will occur not within the LAN but in WAN (internet). arping is a fine tool but what if you do not have control to the machine conflicting with your server... just a thought. Hope there could be a good remedy on it aside from tracing the conflicting machine.

Again, thank you.


LAT

[Stuart Browne]

Forcing ARP tables on switches/routers is about as close as you can get to forcibly disallow IP conflicts.

It doesn't stop a user from trying to use an already assigned IP, but at least if the ARP tables in the switch/routers are forced (read: static, not dynamic), even if the users do do the stupid, it won't harm as much.

But SEP is right. You do need a *SINGLE* person, or process, to assign IP addresses to users/admins. Having a distributed collective dole out addresses is just asking for pain.

[Stuart Browne]

Oh, note.. Manually (statically) filling in ARP tables is a painful, PAINFUL process. I'd not reccomend using this method for a large amount of systems, but it can be useful for a few core systems which require just a little more stability than the rest of the users.

[Johannes Krackowizer_1]

hi,

static arp tables in switches are very nice but i don't use them because it's horrible to update them everytime you change something in the network (for example replace a broken nic in a workstation or someone wants to connect his notebook to the network, ...). my solution to the problem was:

set up a dhcp server.
the servers got static ip adresses (172.16.0.x)
the employes can't change there ip settings and there computers are configuered to use dhcp.
The dhcp server has an address pool (172.16.2.x - 172.16.254.x).
For special computers (print-servers, propitary software on some clients, ...) i have reserved ip-addresses (172.16.1.x). The ip's are connected with a mac address so i have to update my reserved ip-mac only if i change some special workstations.

johannes

[Yu Wang_1]

Try to put all servers in a VLAN and put rest of ports that allow users to plugin in a different VLAN. This way, user can only mess up within that VLAN.

--Yu

[Yong_7]

Hi Leovino,

if you major concern is public IP conflict. say the Public IPs you got from your ISP conflict with other customers like you. then in order to trace to who have that conflict IPs, the ISP would be good contact.

of course, to trace who is using the IPs you think belong to you, ARP will help you and your ISP to dig that out. as other folks mentioned before, we need well-maintained operation process to handle IP assignment internally ( your company )/ externally ( ISP etc. )

YJ