Duplicate IP's

[samonish]

I have an issue where at one of our manufacturing plants where we run multiple VLAN's, several of the production equipment port connections are showing up on the equipment as a duplicate IP, and the equipment will not come online. it involves 8 ports, all the equipment has static IP's assigned all outside the DHCP scope. however I don't see anything in the logs on the switch, and when I search for the IP's I only see them on the switch and port they are connected to. and only the static assigned equipment shows having the IP that is assigned to it. and the problem seems to be random, it may run ok for a couple of days then it starts showing up as duplicate IP's at the node end only, but it'll be all 10 nodes. this all started happening after adding the VLAN to additional ports on other switches. the config is the same across the board to all switches needing access to the VLAN. this VLAN is for production equipment only and not shared with any other type of node.

[kevin.szatkowski]

Samonish,

     I think the key word is after you added the VLAN to additional ports on other switches.  What I believe is happening is that other end nodes have the same IPs assigned within the same VLAN.

     Are you running a version of Windows on your nodes?  When a node comes up on the network it sends a Gratuitous ARP announcing it IP and MAC.  On Windows the older node will respond and the younger node will revert and give an error I believe.

     To troublshoot, when it happens again, temporary shutdown the interface (make sure you can legally) of the correct node and then attempt to ping the IP.  If successful, I would start at the switch/router that has your gateway and run "show ip arp" to locate where the IP/MAC is coming from, then work your way back to the port.  If not, we might need to see how your topology and VLANs are setup.

Looking forward to your reply,

Kevin

[samonish]

thanks Kevin,

thanks Kevin, we have tried exactly that and there is no other device on the subnet with the duplicate IP. when we open the port again immediately the end node (the production equipment) be it the boiler monitor equipment, or a guillotine press console shows a duplicate IP error at the end node. another noted item, if you take each node off of the subnet and connect them via a hub not attached to the subnet they can communicate together without error, as soon as you plug them back into the network they all show a duplicate IP error at the individual console. you can plug a laptop or PC into the same port on the switch and it shows no error. we have tried changing ports on the switch that the equipment is plugged into and get  the same error.

I am inclined to think the problem lies at the end node, except it happens to all 8 consoles on all 8 ports at the same time regardless of which port it is plugged into.

[kevin.szatkowski]

Actually if you have a laptop with wireshark, put an interface in the same VLAN and do a capture with the arp filter.  Wireshark should show you if duplicate IPs show up and give you the MACs that are using the same IPs.

Kevin

[samonish]

Sorry Kevin I have been out of the office for a couple of days. I will give this a try and see if we can identify if there are dup IP's on the subnet. the end user at the location told me the production equipment in question is configured in a ring topology, not sure if that would reflect as dups in this environment. I can still send the scrubbed config if needed.

[kevin.szatkowski]

Even in a ring, STP should be stopping the loop at one point.  Looking forward to hearing back.

[samonish]

i do apologies for not getting back, after the problem resolved it self the end users didnt get back to me with what solved the problem. they replaced the controller on the main robotic servo and the dup ip issue went away. problem was in the allen bradley controller, but it never was specifically identified as to what exactly the problem was. at any rate case closed.

[samonish]

Kevin here is a copy of the wireshark, the static ip's in question range from .117.203 - .117.210. I don't see anything indicating dup ip's. the exitension will have to be changed back to a wireshark suffix.

[kevin.szatkowski]

I'm not seeing it either.  So I think it's an application issue.  What is reporting duplicate IPs?

[samonish]

the devices reporting the duplicate IP's are

Rockwell, Allen Bradley servo drives. They are Kinetix 5500 cat # 2198-H003-ER8 used.