IP Address Conflict.

Discussion in 'Cisco' started by techjohnny@gmail.com, Sep 2, 2008.

  1. Guest

    I'm getting a broadcast of an IP Address Conflict, but several
    machines are reporting the same MAC address that are part of this
    message. I've searched our arp tables on linux and have multiple
    entries of ip addresses that are different, but the mac addresses are
    the same, and when I go to the machine, the mac address is entirely
    different.

    Now it looks like the mac address that is linked to multiple ips in
    the arp table all point to the Cisco router, how can I fix this to
    correct the mac addresses, and shouldn't this fix the ip address
    conflict message?

    The error message isn't preventing any users to access the network.
    It's just a broadcast message.

    Thanks,

    --tj
    , Sep 2, 2008
    #1
    1. Advertising

  2. Juki Guest

    wrote:
    > I'm getting a broadcast of an IP Address Conflict, but several
    > machines are reporting the same MAC address that are part of this
    > message. I've searched our arp tables on linux and have multiple
    > entries of ip addresses that are different, but the mac addresses are
    > the same, and when I go to the machine, the mac address is entirely
    > different.
    >
    > Now it looks like the mac address that is linked to multiple ips in
    > the arp table all point to the Cisco router, how can I fix this to
    > correct the mac addresses, and shouldn't this fix the ip address
    > conflict message?
    >
    > The error message isn't preventing any users to access the network.
    > It's just a broadcast message.


    Is there proxy arp enabled in your Cisco router?
    And too wide subnet mask in your workstations?

    JV
    Juki, Sep 2, 2008
    #2
    1. Advertising

  3. Guest

    On Sep 2, 1:32 pm, Juki <> wrote:
    > wrote:
    > > I'm getting a broadcast of an IP Address Conflict, but several
    > > machines are reporting the same MAC address that are part of this
    > > message. I've searched our arp tables on linux and have multiple
    > > entries of ip addresses that are different, but the mac addresses are
    > > the same, and when I go to the machine, the mac address is entirely
    > > different.

    >
    > > Now it looks like the mac address that is linked to multiple ips in
    > > the arp table all point to the Cisco router, how can I fix this to
    > > correct the mac addresses, and shouldn't this fix the ip address
    > > conflict message?

    >
    > > The error message isn't preventing any users to access the network.
    > > It's just a broadcast message.

    >
    > Is there proxy arp enabled in your Cisco router?
    > And too wide subnet mask in your workstations?
    >
    > JV


    Well, we have a subnet at 10.1.10.0/255.0.0.0 and
    10.3.10.0/255.255.255.0, but this has been in place for a couple years
    now without any problems, but just recently this message starting
    occurring.

    --tj
    , Sep 5, 2008
    #3
  4. Guest

    On Sep 5, 8:32 am, "" <>
    wrote:
    > On Sep 2, 1:32 pm, Juki <> wrote:
    >
    >
    >
    > > wrote:
    > > > I'm getting a broadcast of an IP Address Conflict, but several
    > > > machines are reporting the same MAC address that are part of this
    > > > message. I've searched our arp tables on linux and have multiple
    > > > entries of ip addresses that are different, but the mac addresses are
    > > > the same, and when I go to the machine, the mac address is entirely
    > > > different.

    >
    > > > Now it looks like the mac address that is linked to multiple ips in
    > > > the arp table all point to the Cisco router, how can I fix this to
    > > > correct the mac addresses, and shouldn't this fix the ip address
    > > > conflict message?

    >
    > > > The error message isn't preventing any users to access the network.
    > > > It's just a broadcast message.

    >
    > > Is there proxy arp enabled in your Cisco router?
    > > And too wide subnet mask in your workstations?

    >
    > > JV

    >
    > Well, we have a subnet at 10.1.10.0/255.0.0.0 and
    > 10.3.10.0/255.255.255.0, but this has been in place for a couple years
    > now without any problems, but just recently this message starting
    > occurring.
    >
    > --tj


    It looks like it was an actually conflict. Strange that the message
    never showed up on the computer, but on a different subnet than the
    machine was on.

    Thanks,

    --tj
    , Sep 5, 2008
    #4
  5. Guest

    On Sep 5, 10:11 am, "" <>
    wrote:
    > On Sep 5, 8:32 am, "" <>
    > wrote:
    >
    >
    >
    > > On Sep 2, 1:32 pm, Juki <> wrote:

    >
    > > > wrote:
    > > > > I'm getting a broadcast of an IP Address Conflict, but several
    > > > > machines are reporting the same MAC address that are part of this
    > > > > message. I've searched our arp tables on linux and have multiple
    > > > > entries of ip addresses that are different, but the mac addresses are
    > > > > the same, and when I go to the machine, the mac address is entirely
    > > > > different.

    >
    > > > > Now it looks like the mac address that is linked to multiple ips in
    > > > > the arp table all point to the Cisco router, how can I fix this to
    > > > > correct the mac addresses, and shouldn't this fix the ip address
    > > > > conflict message?

    >
    > > > > The error message isn't preventing any users to access the network.
    > > > > It's just a broadcast message.

    >
    > > > Is there proxy arp enabled in your Cisco router?
    > > > And too wide subnet mask in your workstations?

    >
    > > > JV

    >
    > > Well, we have a subnet at 10.1.10.0/255.0.0.0 and
    > > 10.3.10.0/255.255.255.0, but this has been in place for a couple years
    > > now without any problems, but just recently this message starting
    > > occurring.

    >
    > > --tj

    >
    > It looks like it was an actually conflict. Strange that the message
    > never showed up on the computer, but on a different subnet than the
    > machine was on.
    >
    > Thanks,
    >
    > --tj


    This continues.

    I'm now running ARPWATCH. It is detecting several IP ADDRESSES as
    flip flop. I'm hoping somebody can help recognize why all these
    addresses are flip flopping? The machine that arp flip flops creates
    a conflict with the Cisco router.

    The machine's HW ether flip flops and changes to the MAC address of
    the Cisco router that separates the two subnets.

    10.0.0.0/8 and 10.3.10.0/24

    Any help would be great.

    Thanks,

    --tj
    , Sep 11, 2008
    #5
  6. wrote:
    >The machine's HW ether flip flops and changes to the MAC address of
    >the Cisco router that separates the two subnets.
    >
    >10.0.0.0/8 and 10.3.10.0/24
    >
    >Any help would be great.


    Poor design there I'm afraid, If those subnets are on the same router, and it's
    a Cisco, the Cisco will be OK, but end systems may be a little unpredictable,
    as one of your subnets falls *within* the other. A /8 is also insanely large.
    Make it smaller. A lot smaller.

    That does give the obvious opportunity for say, 10.3.10.42 to be allocated on
    both sides. The Cisco will send any traffic for it to the interface with
    10.3.10.0/24 though, not to 10.0.0.0/8. Any device on 10.0.0.0/8 will think it
    is local and will ARP for it rather than using the gateway.

    Is there only the one Cisco router? Are you using anything like HSRP or GLBP? I
    would imagine GLBP would confuse something like arpwatch!
    --
    Paul Matthews CCIE #4063
    Please post questions to the NG, NOT by e-mail.
    Paul Matthews, Sep 11, 2008
    #6
  7. Guest

    On Sep 11, 12:16 pm, Paul Matthews <> wrote:
    > wrote:
    > >The machine's HW ether flip flops and changes to the MAC address of
    > >the Cisco router that separates the two subnets.

    >
    > >10.0.0.0/8 and 10.3.10.0/24

    >
    > >Any help would be great.

    >
    > Poor design there I'm afraid, If those subnets are on the same router, and it's
    > a Cisco, the Cisco will be OK, but end systems may be a little unpredictable,
    > as one of your subnets falls *within* the other. A /8 is also insanely large.
    > Make it smaller. A lot smaller.
    >
    > That does give the obvious opportunity for say, 10.3.10.42 to be allocated on
    > both sides. The Cisco will send any traffic for it to the interface with
    > 10.3.10.0/24 though, not to 10.0.0.0/8. Any device on 10.0.0.0/8 will think it
    > is local and will ARP for it rather than using the gateway.
    >
    > Is there only the one Cisco router? Are you using anything like HSRP or GLBP? I
    > would imagine GLBP would confuse something like arpwatch!
    > --
    > Paul Matthews CCIE #4063
    > Please post questions to the NG, NOT by e-mail.


    This started after on the end stations moved from the old subnet
    10.0.0.0/8 to the new subnet 10.3.10.0/24. This is a Windows XP
    workstation that included an ip printer.

    --tj
    , Sep 11, 2008
    #7
  8. wrote:

    >This started after on the end stations moved from the old subnet
    >10.0.0.0/8 to the new subnet 10.3.10.0/24. This is a Windows XP
    >workstation that included an ip printer.


    You probably have something with the wrong address in the wrong place - is
    there any bridging between the subnets at all?
    --
    Paul Matthews CCIE #4063
    Please post questions to the NG, NOT by e-mail.
    Paul Matthews, Sep 12, 2008
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?Um9uIFA=?=

    Windows System Error (IP Address Conflict)

    =?Utf-8?B?Um9uIFA=?=, Jan 24, 2005, in forum: Wireless Networking
    Replies:
    7
    Views:
    41,480
    Yves Konigshofer
    Jan 25, 2005
  2. Charles Kenyon

    IP Address conflict

    Charles Kenyon, Mar 15, 2005, in forum: Wireless Networking
    Replies:
    18
    Views:
    16,683
    =?Utf-8?B?U3RhdE1hbg==?=
    Apr 7, 2005
  3. Howard Woodard

    IP Address Conflict...

    Howard Woodard, Dec 5, 2005, in forum: Wireless Networking
    Replies:
    3
    Views:
    10,688
  4. macro
    Replies:
    10
    Views:
    232,277
    hbpak
    Mar 19, 2008
  5. mary wei
    Replies:
    2
    Views:
    5,304
    127.0.0.1
    Aug 24, 2004
Loading...

Share This Page