problem with IP thief
 

Hi people!
I'm having trouble with someone stealing my IP-number. Occasionally I
get the error message "A conflict has occurred for ip-number: <my ip>
with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
like that (translated from swedish). I'm running win98, connected to the
internet on the university LAN. So I do have his/hers hardware address.
How can I find out his/hers IP from it? Then I figure I could also
locate him/her. Can this be done? Thanks in advance for all replies.
/Olof Johansson

Re: problem with IP thief
 

Olof Johansson wrote:

> Hi people!
> I'm having trouble with someone stealing my IP-number. Occasionally I
> get the error message "A conflict has occurred for ip-number: <my ip>
> with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
> like that (translated from swedish). I'm running win98, connected to the
> internet on the university LAN. So I do have his/hers hardware address.
> How can I find out his/hers IP from it? Then I figure I could also
> locate him/her. Can this be done? Thanks in advance for all replies.


I'm sure there are other ways, but when this happened to me I used one
of the popular unix servers on campus to figure it out.

I did the following command:
last | grep <hostname>

I just looked to see which login wasn't me.


-WD

Re: problem with IP thief
 

In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
olofjoh@hotmail.com says...
> Hi people!
> I'm having trouble with someone stealing my IP-number. Occasionally I
> get the error message "A conflict has occurred for ip-number: <my ip>
> with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
> like that (translated from swedish). I'm running win98, connected to the
> internet on the university LAN. So I do have his/hers hardware address.
> How can I find out his/hers IP from it? Then I figure I could also
> locate him/her. Can this be done? Thanks in advance for all replies.
> /Olof Johansson
>


it's probably not a theft, it's probably a misconfigured computer set
with a static IP address. do you use DHCP to achieve IP connectivity? If
so, you probably were assigned X and this person set their computer as a
static, it being X also, therefore, causing the error. If you're DHCP,
reboot.



--
Colonel Flagg
http://www.internetwarzone.org/

Privacy at a click:
http://www.cotse.net

Q: How many Bill Gates does it take to change a lightbulb?
A: None, he just defines Darkness? as the new industry standard..."

"...I see stupid people."

Re: problem with IP thief
 

Colonel Flagg wrote:
> In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
> olofjoh@hotmail.com says...
>
>>Hi people!
>>I'm having trouble with someone stealing my IP-number. Occasionally I
>>get the error message "A conflict has occurred for ip-number: <my ip>
>>with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
>>like that (translated from swedish). I'm running win98, connected to the
>>internet on the university LAN. So I do have his/hers hardware address.
>>How can I find out his/hers IP from it? Then I figure I could also
>>locate him/her. Can this be done? Thanks in advance for all replies.
>>/Olof Johansson
>>
>
>
>
> it's probably not a theft, it's probably a misconfigured computer set
> with a static IP address. do you use DHCP to achieve IP connectivity?

Yes. But I always get the same IP-number.

If
> so, you probably were assigned X and this person set their computer as a
> static, it being X also, therefore, causing the error. If you're DHCP,
> reboot.
>
Rebooting still gives me the same IP-number, same as always. And yes,
the person must have set the ip manually. I'm thinking this could be a
way of not getting caught by the admins using a p2p-program which are
prohibited on the network (because they give too much traffic overall).
I just don't like it since I don't want any problem of that kind + I
dont want my web- and mailpages to go to another computer. I've tipped
off the security guys about it, but I don't really count on them getting
the job done. What can I do with the hw-adress I have, from my computer
running win98? (I don't have access to a unix system or a network
server.) Or should I change my ip manually too (seems like a bad idea,
though)?
>
>

Re: problem with IP thief
 

In article <c0jloo$17lunb$1@ID-224573.news.uni-berlin.de>,
olofjoh@hotmail.com says...
> Colonel Flagg wrote:
> > In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
> > olofjoh@hotmail.com says...
> >
> >>Hi people!
> >>I'm having trouble with someone stealing my IP-number. Occasionally I
> >>get the error message "A conflict has occurred for ip-number: <my ip>
> >>with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
> >>like that (translated from swedish). I'm running win98, connected to the
> >>internet on the university LAN. So I do have his/hers hardware address.
> >>How can I find out his/hers IP from it? Then I figure I could also
> >>locate him/her. Can this be done? Thanks in advance for all replies.
> >>/Olof Johansson
> >>
> >
> >
> >
> > it's probably not a theft, it's probably a misconfigured computer set
> > with a static IP address. do you use DHCP to achieve IP connectivity?
>
> Yes. But I always get the same IP-number.
>
> If
> > so, you probably were assigned X and this person set their computer as a
> > static, it being X also, therefore, causing the error. If you're DHCP,
> > reboot.
> >
> Rebooting still gives me the same IP-number, same as always. And yes,
> the person must have set the ip manually. I'm thinking this could be a
> way of not getting caught by the admins using a p2p-program which are
> prohibited on the network (because they give too much traffic overall).
> I just don't like it since I don't want any problem of that kind + I
> dont want my web- and mailpages to go to another computer. I've tipped
> off the security guys about it, but I don't really count on them getting
> the job done. What can I do with the hw-adress I have, from my computer
> running win98? (I don't have access to a unix system or a network
> server.) Or should I change my ip manually too (seems like a bad idea,
> though)?
> >
> >
>


the DHCP server could be binding your MAC to the IP address. When you
get the message next time, run winipcfg from start -> run, and
release/renew for the ethernet adapter. this should theoretically pull
the new IP from the dhcp pool.

if however your theory is correct, sooner or later, someone will use
your new IP address, then you'll be back to square one.



--
Colonel Flagg
http://www.internetwarzone.org/

Privacy at a click:
http://www.cotse.net

Q: How many Bill Gates does it take to change a lightbulb?
A: None, he just defines Darkness? as the new industry standard..."

"...I see stupid people."

Re: problem with IP thief
 

On Sat, 14 Feb 2004 00:19:22 +0100, Olof Johansson
<olofjoh@hotmail.com> wrote:
<snip>

>I just don't like it since I don't want any problem of that kind + I
>dont want my web- and mailpages to go to another computer.

The IP address just allows you to use the network, your mail
and access to any web pages you own are protected by
a userid and password.

Look at your settings and see if you have an IP address
permenantly set in the machine or if its allocated by a
server. Either way its not a big deal, talk to whoever
manages the network.
--
Jim Watt http://www.gibnet.com

Re: problem with IP thief
 

On Sat, 14 Feb 2004 00:19:22 +0100, Olof Johansson
<olofjoh@hotmail.com> wrote:

>Colonel Flagg wrote:
>> In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
>> olofjoh@hotmail.com says...
>>
>>>Hi people!
>>>I'm having trouble with someone stealing my IP-number. Occasionally I
>>>get the error message "A conflict has occurred for ip-number: <my ip>
>>>with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
>>>like that (translated from swedish). I'm running win98, connected to the
>>>internet on the university LAN. So I do have his/hers hardware address.
>>>How can I find out his/hers IP from it? Then I figure I could also
>>>locate him/her. Can this be done? Thanks in advance for all replies.
>>>/Olof Johansson
>>>
>>
>>
>>
>> it's probably not a theft, it's probably a misconfigured computer set
>> with a static IP address. do you use DHCP to achieve IP connectivity?
>
>Yes. But I always get the same IP-number.
>
that is because the DHCP server has given you a lease.
do ipconfig /release and ipconfig /renew from the command prompt.
misconfigured DHCP servers with dodgy reservations, rogue servers and
rouge statics were always a big problem in corporate (nazi) settings .
this should give you a different ip (if it doesnt you can try picking
a manual one but that is probably what the other person has done in
the first place and may cause someone else to have the same problem as
you ).
then you can do a ping -a ip.address.you.crave
to find out a bit more about who has the ip address.
also nbtstat -a ip.address.you.crave and arp -a ip.address.you.crave
to get the MAC address.

sam [ ex-MCSE :-) ]

Re: problem with IP thief
 

Olof Johansson <olofjoh@hotmail.com> wrote in news:c0jin0$181cdn$1@ID-
224573.news.uni-berlin.de:

> Hi people!
> I'm having trouble with someone stealing my IP-number. Occasionally I
> get the error message "A conflict has occurred for ip-number: <my ip>
> with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
> like that (translated from swedish). I'm running win98, connected to the
> internet on the university LAN. So I do have his/hers hardware address.
> How can I find out his/hers IP from it? Then I figure I could also
> locate him/her. Can this be done? Thanks in advance for all replies.
> /Olof Johansson

it's not a thief. it's just duplicate ip address on same subnet.

here is what you can do. while your machine is working - no conflicts. ping
a few ip's up & down from you. write down the ones that are available. also
write down your gateway, dns settings.

when it happens again, change your ip to manual to the one the ones that
were available, also input your other GW & DNS setting. then ping & arp -a
to get MAC address of duplicate ip host. send the MAC address to the sys
admin and tell them what happened.

:-)



--
Rowdy Yates
Things I learnt in the army:
-------------------------------
Rule #1 -
When they say, "We are going to ambush the enemy".
It really means, "We are heavily outnumbered and no one wants to help us."
-------------------------------
I am Against-TCPA
http://www.againsttcpa.com

Re: problem with IP thief
 

In article <kdtr209iff7c6gumv2l13uiub58d1m2otn@4ax.com>, sam1967
@hetnet.nl says...
> On Sat, 14 Feb 2004 00:19:22 +0100, Olof Johansson
> <olofjoh@hotmail.com> wrote:
>
> >Colonel Flagg wrote:
> >> In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
> >> olofjoh@hotmail.com says...
> >>
> >>>Hi people!
> >>>I'm having trouble with someone stealing my IP-number. Occasionally I
> >>>get the error message "A conflict has occurred for ip-number: <my ip>
> >>>with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
> >>>like that (translated from swedish). I'm running win98, connected to the
> >>>internet on the university LAN. So I do have his/hers hardware address.
> >>>How can I find out his/hers IP from it? Then I figure I could also
> >>>locate him/her. Can this be done? Thanks in advance for all replies.
> >>>/Olof Johansson
> >>>
> >>
> >>
> >>
> >> it's probably not a theft, it's probably a misconfigured computer set
> >> with a static IP address. do you use DHCP to achieve IP connectivity?
> >
> >Yes. But I always get the same IP-number.
> >
> that is because the DHCP server has given you a lease.
> do ipconfig /release and ipconfig /renew from the command prompt.
> misconfigured DHCP servers with dodgy reservations, rogue servers and
> rouge statics were always a big problem in corporate (nazi) settings .
> this should give you a different ip (if it doesnt you can try picking
> a manual one but that is probably what the other person has done in
> the first place and may cause someone else to have the same problem as
> you ).
> then you can do a ping -a ip.address.you.crave
> to find out a bit more about who has the ip address.
> also nbtstat -a ip.address.you.crave and arp -a ip.address.you.crave
> to get the MAC address.
>
> sam [ ex-MCSE :-) ]
>
>
>


he's using win98, which doesn't have ipconfig, it has winipcfg, probably
doesn't have nbtstat or arp, but maybe... depends what was installed
previously.

--
Colonel Flagg
http://www.internetwarzone.org/

Privacy at a click:
http://www.cotse.net

Q: How many Bill Gates does it take to change a lightbulb?
A: None, he just defines Darkness? as the new industry standard..."

"...I see stupid people."

Re: problem with IP thief
 

On Sat, 14 Feb 2004 12:09:21 -0500, Colonel Flagg
<colonel_flagg@NOSOUPFORJ00internetwarzone.org> wrote:

>In article <kdtr209iff7c6gumv2l13uiub58d1m2otn@4ax.com>, sam1967
>@hetnet.nl says...
>> On Sat, 14 Feb 2004 00:19:22 +0100, Olof Johansson
>> <olofjoh@hotmail.com> wrote:
>>
>> >Colonel Flagg wrote:
>> >> In article <c0jin0$181cdn$1@ID-224573.news.uni-berlin.de>,
>> >> olofjoh@hotmail.com says...
>> >>
>> >>>Hi people!
>> >>>I'm having trouble with someone stealing my IP-number. Occasionally I
>> >>>get the error message "A conflict has occurred for ip-number: <my ip>
>> >>>with the system with hardware adress xx:xx:xx:xx:xx:xx" or something
>> >>>like that (translated from swedish). I'm running win98, connected to the
>> >>>internet on the university LAN. So I do have his/hers hardware address.
>> >>>How can I find out his/hers IP from it? Then I figure I could also
>> >>>locate him/her. Can this be done? Thanks in advance for all replies.
>> >>>/Olof Johansson
>> >>>
>> >>
>> >>
>> >>
>> >> it's probably not a theft, it's probably a misconfigured computer set
>> >> with a static IP address. do you use DHCP to achieve IP connectivity?
>> >
>> >Yes. But I always get the same IP-number.
>> >
>> that is because the DHCP server has given you a lease.
>> do ipconfig /release and ipconfig /renew from the command prompt.
>> misconfigured DHCP servers with dodgy reservations, rogue servers and
>> rouge statics were always a big problem in corporate (nazi) settings .
>> this should give you a different ip (if it doesnt you can try picking
>> a manual one but that is probably what the other person has done in
>> the first place and may cause someone else to have the same problem as
>> you ).
>> then you can do a ping -a ip.address.you.crave
>> to find out a bit more about who has the ip address.
>> also nbtstat -a ip.address.you.crave and arp -a ip.address.you.crave
>> to get the MAC address.
>>
>> sam [ ex-MCSE :-) ]
>>
>>
>>
>
>
>he's using win98, which doesn't have ipconfig, it has winipcfg,

what a pedant. i meant winipcfg. if he doesnt know how to release and
renew his ip address he shouldnt be using a computer.

>probably
>doesn't have nbtstat or arp, but maybe... depends what was installed
>previously.

of course he has arp and nbtstat . ever heard of a tcpip stack ?