detecting duplicate ips

[robertkwild]

hi all,

is there a command to run to detect if i have duplicate ips on a vlan

thanks,

rob

[aleabrahao]

Although the question was somewhat vague and lacked further details, I assume you are referring to Cisco switches, is that correct?

Here are some useful commands.

show arp vlan <vlan-id>

show ip device tracking all

show ip dhcp snooping binding

show ip dhcp  binding

show ip verify source

[robertkwild]

thanks @aleabrahao i imagine if i did have a duplicate and i issue this command

show arp vlan <vlan-id>

it would show two same ips with different macs

[aleabrahao]

Not necessarily. The ARP table can only hold one MAC address per IP address at any given moment. If two devices are using the same IP, what you typically see is the ARP entry flapping between the two MAC addresses rather than two simultaneous entries.

[Joseph W. Doherty]

Hmm, don't recall a specific command, on a switch or router that would immediately highlight a dup IP on the network.  That's not to say there's not commands to help identify the offending host MACs, just no simple command, that comes to my mind, to show the conflict.

If DHCP is involved, the DHCP server, will likely see the initial conflict and log it.  Ideally, DHCP shouldn't allocate an IP with a current conflict.

Most hosts, I believe, may notice an immediate IP conflict, when they come on-line to the network.  A DHCP host, when coming on-line, should, I believe, try to obtain another IP if an IP conflict is detected.

I don't recall whether there's a standard for hard IP configured hosts.  I believe most may also immediately notice the conflict when they join the network (via gratius ARP), but unsure what that will do if they detect an IP conflict.  (I would expect any host that detects the IP conflict will "complain", again, for non-DHCP hosts, don't know whether they will still go on-line or block themselves [as they cannot just try to use another "available" DHCP IP].)

The most likely way I see this happening is multiple hosts with hard coded IPs that don't try to insure they have a unique IP, for their network, when they join the network.  (Again, most likely would be some kind of host providing the most primitive IP implementation.)

Symptoms of an IP conflict would be erratic network functioning of the hosts with a concurrent IP config, or something like what @aleabrahao described, an ARP table IP's MAC constantly changing (or a switch's MAC table MAC's port constantly changing).

Understand, a host with an IP conflict can work perfectly provided they are not concurrently on the network at the same time. (This conflict might be found by recording the ARP or switch MAC table looking for changed values for an IP/MAC or MAC/port pair.)

Lastly, are you suspecting an IP conflict?  If so, why?  I ask, because depending on "symptoms" possibly there's a different cause than an IP dup conflict.  (Decades ago, when we commonly manually maintained host IP and the hosts didn't try to detect dup conflicts, themselves, this was not a totally uncommon issue.)

[robertkwild]

tbh a website was just taking ages to load and our support thought it was because there was a duplicate ip and thats why but when i ssh in the host, its ssh'ing to the right host 

[aleabrahao]

@robertkwild 

To be quite honest, usually when there’s a duplicate IP, the switch’s own logs will generate alerts.

Based on your explanation, it seems unlikely that this is the actual issue. How did they arrive at that conclusion? Or was it just a guess they made without investigating further?

[Joseph W. Doherty]

tbh a website was just taking ages to load and our support thought it was because there was a duplicate ip and thats why but when i ssh in the host, its ssh'ing to the right host 

And on a later reply, you note a dup IP seems to be a "guess" offered by "support" as a possible cause of slow website access, correct?

Well, yes a dup IP can cause problems, but I suspect very slow web site loading is more likely to have a different cause.

Possibly your "support" might do less assuming and more analysis.

BTW, have you ever seen the break down of the word assume?  I.e. ass-u-me.  (Laugh, almost 5 decades ago, this was explained to me by my senior programmer when I came to him with some assumption.)

[robertkwild]

he just assumed so a guess

how do i look at the logs please @aleabrahao , basically we have layer 2 switches (8) and they all lead back to 2 layer3 switches (i ran the command from one of the layer 3 switches)

[aleabrahao]

@robertkwild try these two commands.

show logging | include DUPADDR

show logging | include duplicate

The switch typically issues an alert like this when it detects a duplicate address: Nov 19 08:59:04.207: %IP-4-DUPADDR: Duplicate address x.x.x.18 on GigabitEthernet0/0, sourced by xxxx.xxxx.f5a4.

But then again, I don’t think that’s the case, I believe your support team is just guessing without having any evidence, or without making even the slightest effort to identify the actual problem.

[robertkwild]

do i have to run this command on all the switches or can i just run it on the layer 3 switches

[aleabrahao]

You only need to check the Layer 3 device that owns the SVI/default gateway for that VLAN.

[robertkwild]

thats very interesting, so running those commands on our layer3 gateway switches produced no results but running those commands on a layer 2 switch (same switch the host is connected to) produces a duplicate ip

[robertkwild]

interesting ive run all the commands on all the switches now and the duplicate ips are the ips of the switches, why would it show this 

[Giuseppe Larosa]

Hello @robertkwild ,

if a switch sends out probes with source IP address its own SVI IP address and destination a multicast or broadcast address it may be able to see it on wire.

I would say that if every switch complains of seeing its own IP address from the network this may not be a real problem but the result of seeing its own frames on wire.

Hope to help

Giuseppe