The problem: two devices on the same subnet are configured with, or have been handed, the same IP address. Both work for a few minutes, then one drops, then the other, and the symptoms move around. Pings succeed and then time out. A web page loads and then stalls. Nothing in the cabling is wrong, which is the part that wastes the afternoon.
Here is how I go about it, and I would like to hear how others do it.
Why it behaves so strangely
IP to MAC mapping on a local segment is done by ARP. Every host and the router keep a small table of which MAC address owns which IP. When two machines claim the same address, each ARP reply overwrites the last one in everyone else's table. Traffic goes to whichever machine answered most recently. Think of two houses with the same street number: the mail carrier delivers to whichever door he tried last, and neither household sees all of its mail.
Steps I follow
- Check the obvious layer first. Confirm the link lights and that the two devices are really on the same VLAN and subnet. A duplicate only matters inside one broadcast domain.
- Look at the ARP table from a third machine, and watch the MAC for the suspect IP change:
arp -n | grep 192.168.10.50
ip neigh show 192.168.10.50
- Run that a few times over a minute. If the MAC flips between two values, you have your answer.
- Check the DHCP server's lease table for that address. A common cause is a device with a static address set inside the DHCP pool, so the server hands the same address to someone else later. Another is a device that was cloned or restored from an image with its static address intact.
- Capture on the segment and filter for ARP.
What it looks like in a capture
tcpdump -n -e -i eth0 arp and host 192.168.10.50
In Wireshark, the display filter arp.duplicate-address-detected flags it, and the Expert Info window will usually mention it as well. What you are looking for by eye is two different source MAC addresses sending ARP replies that both say "192.168.10.50 is at" a different MAC. Many operating systems also send a gratuitous ARP or an ARP probe when an interface comes up, and a conflict shows as someone answering that probe. If you see replies from two MACs within seconds of each other, that is the signature.
Tracing the MAC to a port
Once you have the two MAC addresses, look them up in the switch's MAC address table to find the port each one sits on. The first three bytes give you the manufacturer, which often narrows it down to a printer, a phone, or a laptop. This is why I keep port labels in the binder: the MAC table tells you the port, and the label tells you the room.
Prevention
Keep static addresses outside the DHCP pool, or use reservations by MAC. Write the assignment down. Some switches offer features that watch ARP and DHCP traffic, but I have not leaned on them in a home setting and will not pretend otherwise.
Questions for the group
How do you track down the second device when the MAC table points at an unmanaged switch or access point with several things behind it? And do you rely on DHCP reservations, a documented static range, or both?