IP Sharing Detected

[Shadius]

Hi all,

I've recently started receiving alerts of IP sharing after a power outage. It goes on to say "NAT has been detected on 1 client in the...," etc. I'm not sure what it means exactly. Prior to the abrupt power outage, I've never received these alerts before. Can someone educate me, please?

Thanks in advance.

[dunky]

Is there any documentation available on this yet?

I've had over 600 alerts today across a dozen sites so it can't be related to duplicate IP addresses. My DHCP server is an MX at each site.

[dunky]

I'm not convinced its related to duplicate IPs due to the volume and geographic spread I am seeing,.

Could it be where a client has both a Wifi and ether connection?

[mcgruff]

Can you propose troubleshooting steps? We're seeing dozens of nat detection alerts on one site but not on others (Same switch, same firmware, same topology on all sites)

[Lonestarr]

Has Meraki produced documentation for this yet? We just turned on a number of alerts for our network and are tweaking them to see what works for us. I read this thread earlier and we decided to get weekly alerts. For this week we have 3 alerts at 3 different offices. One is here at our HQ and I was able to find who it is and verify there was no issue. But the other two are clear across the country, and one of them is on wifi so I can't cycle the port as suggested above. How do we troubleshoot these alerts to determine whether it's a false positive or a legit concern, without physically going to the device and looking for vmware (which shouldn't be on it based on group policies anyway)?

[craig00011111111111111]

"Modern operating systems use a number of tracking prevention methods that can resemble the behaviour of many hosts behind a single NAT IP. Therefore NAT detection may also cause alerts for legitimate traffic that may not be related to NAT.

It is recommended to tune the alert frequency to a suitable value for your network, then investigate to determine whether further action should be taken."

So, it might be real, might be false positive...and we're supposed to go investigate them all? I'm not sure this is very helpful.

[dunky]

Agreed, I've turned it off.

About as useful as the warning of clients with bad WiFi connection - tells you AP's and how many clients (not sure I believe it as its always 5) but not which ones!