Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > IP Address Conflict.

Reply
Thread Tools

IP Address Conflict.

 
 
techjohnny@gmail.com
Guest
Posts: n/a
 
      09-02-2008
I'm getting a broadcast of an IP Address Conflict, but several
machines are reporting the same MAC address that are part of this
message. I've searched our arp tables on linux and have multiple
entries of ip addresses that are different, but the mac addresses are
the same, and when I go to the machine, the mac address is entirely
different.

Now it looks like the mac address that is linked to multiple ips in
the arp table all point to the Cisco router, how can I fix this to
correct the mac addresses, and shouldn't this fix the ip address
conflict message?

The error message isn't preventing any users to access the network.
It's just a broadcast message.

Thanks,

--tj
 
Reply With Quote
 
 
 
 
Juki
Guest
Posts: n/a
 
      09-02-2008
http://www.velocityreviews.com/forums/(E-Mail Removed) wrote:
> I'm getting a broadcast of an IP Address Conflict, but several
> machines are reporting the same MAC address that are part of this
> message. I've searched our arp tables on linux and have multiple
> entries of ip addresses that are different, but the mac addresses are
> the same, and when I go to the machine, the mac address is entirely
> different.
>
> Now it looks like the mac address that is linked to multiple ips in
> the arp table all point to the Cisco router, how can I fix this to
> correct the mac addresses, and shouldn't this fix the ip address
> conflict message?
>
> The error message isn't preventing any users to access the network.
> It's just a broadcast message.


Is there proxy arp enabled in your Cisco router?
And too wide subnet mask in your workstations?

JV
 
Reply With Quote
 
 
 
 
techjohnny@gmail.com
Guest
Posts: n/a
 
      09-05-2008
On Sep 2, 1:32 pm, Juki <(E-Mail Removed)> wrote:
> (E-Mail Removed) wrote:
> > I'm getting a broadcast of an IP Address Conflict, but several
> > machines are reporting the same MAC address that are part of this
> > message. I've searched our arp tables on linux and have multiple
> > entries of ip addresses that are different, but the mac addresses are
> > the same, and when I go to the machine, the mac address is entirely
> > different.

>
> > Now it looks like the mac address that is linked to multiple ips in
> > the arp table all point to the Cisco router, how can I fix this to
> > correct the mac addresses, and shouldn't this fix the ip address
> > conflict message?

>
> > The error message isn't preventing any users to access the network.
> > It's just a broadcast message.

>
> Is there proxy arp enabled in your Cisco router?
> And too wide subnet mask in your workstations?
>
> JV


Well, we have a subnet at 10.1.10.0/255.0.0.0 and
10.3.10.0/255.255.255.0, but this has been in place for a couple years
now without any problems, but just recently this message starting
occurring.

--tj
 
Reply With Quote
 
techjohnny@gmail.com
Guest
Posts: n/a
 
      09-05-2008
On Sep 5, 8:32 am, "(E-Mail Removed)" <(E-Mail Removed)>
wrote:
> On Sep 2, 1:32 pm, Juki <(E-Mail Removed)> wrote:
>
>
>
> > (E-Mail Removed) wrote:
> > > I'm getting a broadcast of an IP Address Conflict, but several
> > > machines are reporting the same MAC address that are part of this
> > > message. I've searched our arp tables on linux and have multiple
> > > entries of ip addresses that are different, but the mac addresses are
> > > the same, and when I go to the machine, the mac address is entirely
> > > different.

>
> > > Now it looks like the mac address that is linked to multiple ips in
> > > the arp table all point to the Cisco router, how can I fix this to
> > > correct the mac addresses, and shouldn't this fix the ip address
> > > conflict message?

>
> > > The error message isn't preventing any users to access the network.
> > > It's just a broadcast message.

>
> > Is there proxy arp enabled in your Cisco router?
> > And too wide subnet mask in your workstations?

>
> > JV

>
> Well, we have a subnet at 10.1.10.0/255.0.0.0 and
> 10.3.10.0/255.255.255.0, but this has been in place for a couple years
> now without any problems, but just recently this message starting
> occurring.
>
> --tj


It looks like it was an actually conflict. Strange that the message
never showed up on the computer, but on a different subnet than the
machine was on.

Thanks,

--tj
 
Reply With Quote
 
techjohnny@gmail.com
Guest
Posts: n/a
 
      09-11-2008
On Sep 5, 10:11 am, "(E-Mail Removed)" <(E-Mail Removed)>
wrote:
> On Sep 5, 8:32 am, "(E-Mail Removed)" <(E-Mail Removed)>
> wrote:
>
>
>
> > On Sep 2, 1:32 pm, Juki <(E-Mail Removed)> wrote:

>
> > > (E-Mail Removed) wrote:
> > > > I'm getting a broadcast of an IP Address Conflict, but several
> > > > machines are reporting the same MAC address that are part of this
> > > > message. I've searched our arp tables on linux and have multiple
> > > > entries of ip addresses that are different, but the mac addresses are
> > > > the same, and when I go to the machine, the mac address is entirely
> > > > different.

>
> > > > Now it looks like the mac address that is linked to multiple ips in
> > > > the arp table all point to the Cisco router, how can I fix this to
> > > > correct the mac addresses, and shouldn't this fix the ip address
> > > > conflict message?

>
> > > > The error message isn't preventing any users to access the network.
> > > > It's just a broadcast message.

>
> > > Is there proxy arp enabled in your Cisco router?
> > > And too wide subnet mask in your workstations?

>
> > > JV

>
> > Well, we have a subnet at 10.1.10.0/255.0.0.0 and
> > 10.3.10.0/255.255.255.0, but this has been in place for a couple years
> > now without any problems, but just recently this message starting
> > occurring.

>
> > --tj

>
> It looks like it was an actually conflict. Strange that the message
> never showed up on the computer, but on a different subnet than the
> machine was on.
>
> Thanks,
>
> --tj


This continues.

I'm now running ARPWATCH. It is detecting several IP ADDRESSES as
flip flop. I'm hoping somebody can help recognize why all these
addresses are flip flopping? The machine that arp flip flops creates
a conflict with the Cisco router.

The machine's HW ether flip flops and changes to the MAC address of
the Cisco router that separates the two subnets.

10.0.0.0/8 and 10.3.10.0/24

Any help would be great.

Thanks,

--tj
 
Reply With Quote
 
Paul Matthews
Guest
Posts: n/a
 
      09-11-2008
(E-Mail Removed) wrote:
>The machine's HW ether flip flops and changes to the MAC address of
>the Cisco router that separates the two subnets.
>
>10.0.0.0/8 and 10.3.10.0/24
>
>Any help would be great.


Poor design there I'm afraid, If those subnets are on the same router, and it's
a Cisco, the Cisco will be OK, but end systems may be a little unpredictable,
as one of your subnets falls *within* the other. A /8 is also insanely large.
Make it smaller. A lot smaller.

That does give the obvious opportunity for say, 10.3.10.42 to be allocated on
both sides. The Cisco will send any traffic for it to the interface with
10.3.10.0/24 though, not to 10.0.0.0/8. Any device on 10.0.0.0/8 will think it
is local and will ARP for it rather than using the gateway.

Is there only the one Cisco router? Are you using anything like HSRP or GLBP? I
would imagine GLBP would confuse something like arpwatch!
--
Paul Matthews CCIE #4063
Please post questions to the NG, NOT by e-mail.
 
Reply With Quote
 
techjohnny@gmail.com
Guest
Posts: n/a
 
      09-11-2008
On Sep 11, 12:16 pm, Paul Matthews <(E-Mail Removed)> wrote:
> (E-Mail Removed) wrote:
> >The machine's HW ether flip flops and changes to the MAC address of
> >the Cisco router that separates the two subnets.

>
> >10.0.0.0/8 and 10.3.10.0/24

>
> >Any help would be great.

>
> Poor design there I'm afraid, If those subnets are on the same router, and it's
> a Cisco, the Cisco will be OK, but end systems may be a little unpredictable,
> as one of your subnets falls *within* the other. A /8 is also insanely large.
> Make it smaller. A lot smaller.
>
> That does give the obvious opportunity for say, 10.3.10.42 to be allocated on
> both sides. The Cisco will send any traffic for it to the interface with
> 10.3.10.0/24 though, not to 10.0.0.0/8. Any device on 10.0.0.0/8 will think it
> is local and will ARP for it rather than using the gateway.
>
> Is there only the one Cisco router? Are you using anything like HSRP or GLBP? I
> would imagine GLBP would confuse something like arpwatch!
> --
> Paul Matthews CCIE #4063
> Please post questions to the NG, NOT by e-mail.


This started after on the end stations moved from the old subnet
10.0.0.0/8 to the new subnet 10.3.10.0/24. This is a Windows XP
workstation that included an ip printer.

--tj
 
Reply With Quote
 
Paul Matthews
Guest
Posts: n/a
 
      09-12-2008
(E-Mail Removed) wrote:

>This started after on the end stations moved from the old subnet
>10.0.0.0/8 to the new subnet 10.3.10.0/24. This is a Windows XP
>workstation that included an ip printer.


You probably have something with the wrong address in the wrong place - is
there any bridging between the subnets at all?
--
Paul Matthews CCIE #4063
Please post questions to the NG, NOT by e-mail.
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VPN with DMZ IP address NETed to LAN IP address!!! route-map!!! examples20001@gmail.com Cisco 0 02-07-2006 04:05 PM
PIX Firewall MAC address VPN IP address Julian Dragut Cisco 1 02-07-2006 07:57 AM
obtaining the IP ADDRESS of an IP POHNE by its MAC ADDRESS ProgDario Cisco 17 05-06-2005 02:32 PM
Routing to public IP of NAT address from internal NAT address Andrew Albert Cisco 1 02-08-2005 07:05 PM
Re: Hide Address Bar or Encrypt Address?? avnrao ASP .Net 1 05-04-2004 03:46 PM



Advertisments