Find a device on my network taking up an ip address
Hello, I'm having a problem I have a network with copiers that are configured wiht static ip's and everything was working fine for months, then all of a sudden the copier started telling me there was an IP conflict. I'm pretty sure that I haven't given this IP to any other devices on my network and had I been set up the one to initially setup the network I would have left a block of IPs that don't get assigned by DHCP but alas I did not so now i am having conflict ip issues. Anyway my question is does anyone know if there is a way for me to find out what device is taking this address and because although I could just change the IP on the printer I already have it mapped to god knows how many computers using that IP. It would be much harder and very time consuming to try and re-map to all computers. I already tried a program called intermapper but I'm guessing there is some issue that is blocking it from working so I was wondering what other alternatives there might be. thanks Or maybe is there a way that I can change a setting now so that I can tell the server not to give out a certian block of IP's. thanks
January 4th, 2012 2:50pm

The best way to to find the duplicate ip addresses is by sniffing. Connect a pc with network monitor or wireshark to the copiers subnet and start to sniff packets. Take one of you copiers (that have a conflict) offline. Try to ping that IP and wait for ARP reply packets that will contain the MAC address of the device. Having the MAC address you can find the device using your network layer-2 switches. Regards, Liran.
Free Windows Admin Tool Kit Click here and download it now
January 4th, 2012 3:21pm

The best way to to find the duplicate ip addresses is by sniffing. Connect a pc with network monitor or wireshark to the copiers subnet and start to sniff packets. Take one of you copiers (that have a conflict) offline. Try to ping that IP and wait for ARP reply packets that will contain the MAC address of the device. Having the MAC address you can find the device using your network layer-2 switches. Regards, Liran.
January 4th, 2012 11:15pm

Hi dgarcia15, Thanks for posting here. We may consider avoiding manually set addresses for hosts but using DHCP server with setting reservations and enabling address conflict detection. Detect and Avoid IP Address Conflicts http://technet.microsoft.com/en-us/magazine/ff606371.aspx I think Liran just gave the way to find out the host that been assigned static address .Hope that is helpful. Thanks. Tiger LiTiger Li TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
January 5th, 2012 3:23am

@Liran : Hello, thanks for your response, I am a new network admin and am mostly learning as I go, this is my first experience with server lvl stuff and I would appreciate it if you give a more detailed explaination of how to go about doing this. What do you mean by copier subnet ? Also to clarify it's not two copiers that are conflicting, it's I gave the copier a static ip and everything was fine for a few months, but i guess over christmas break sometime the copier was turned off and since the copier was not reserving that IP when some other device came on the network, the server assigned it that IP creating the conflict when the copier was turned back on. So I'm guessing that network monitor or wireshark are packet sniffing programs ? If so then that makes a little more sense. Once I get the mac from sniffing packets how to I find the device using my network layer-2 switches. I don't have access to all those things as I work in a school and "central" DOE has lots of stuff locked down.
January 5th, 2012 7:40am

@Tiger LI: Thanks for your response, as I mentioned in my response to Liran, I am new fairly new network admin and I am pretty much learing as I go, how do I set the DHCP server to reserve blocks of ip addresses, and I am going to take your advice and enable address conflict detection after I have resolved this issue. As far as avioding setting the IP manually, thats just how it's done in this enviornment, don't ask me why, normally they want all network printers set static, now as I said earlier I wasn't the one that setup this server so, although I don't know all that much I do know enough from reading some the MCSE and MCSA books that in the beginning you should set a deticated block of IP's that will be reserved and then those are the ones you should use for devices you want to have static IP's. thanks again and I look forward to hearing back from both of you.
Free Windows Admin Tool Kit Click here and download it now
January 5th, 2012 7:50am

Hi dgarcia15, Thanks for posting here. We may consider avoiding manually set addresses for hosts but using DHCP server with setting reservations and enabling address conflict detection. Detect and Avoid IP Address Conflicts http://technet.microsoft.com/en-us/magazine/ff606371.aspx I think Liran just gave the way to find out the host that been assigned static address .Hope that is helpful. Thanks. Tiger LiTiger Li TechNet Community Support
January 5th, 2012 11:18am

Hi dgarcia15, Thanks for update. Usually system will record the MAC address of the host that also set or get same IP address on host that gets conflict prompt, we can verify that form that record in event viewer on conflicted host . Event ID 4199 — TCP/IP Network Interface Configuration http://technet.microsoft.com/en-us/library/cc727689(WS.10).aspx This MAC address will help us the locate the port that that host connects with by verifying the MAC address table on the switch devices that all hosts connect with , but we have to first ensure this is a manageable switch device which can be managed form build-in web interface or command interface. Thanks. Tiger LiTiger Li TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
January 10th, 2012 12:42am

Meanwhile, for the background information please refer to the blog article below: http://blogs.technet.com/b/networking/archive/2009/03/30/tcp-ip-networking-from-the-wire-up.aspx Thanks. Tiger LiTiger Li TechNet Community Support
January 10th, 2012 12:44am

Hi dgarcia15, Thanks for update. Usually system will record the MAC address of the host that also set or get same IP address on host that gets conflict prompt, we can verify that form that record in event viewer on conflicted host . Event ID 4199 — TCP/IP Network Interface Configuration http://technet.microsoft.com/en-us/library/cc727689(WS.10).aspx This MAC address will help us the locate the port that that host connects with by verifying the MAC address table on the switch devices that all hosts connect with , but we have to first ensure this is a manageable switch device which can be managed form build-in web interface or command interface. Thanks. Tiger LiTiger Li TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
January 10th, 2012 8:37am

Meanwhile, for the background information please refer to the blog article below: http://blogs.technet.com/b/networking/archive/2009/03/30/tcp-ip-networking-from-the-wire-up.aspx Thanks. Tiger LiTiger Li TechNet Community Support
January 10th, 2012 8:40am

Use ip\mac scanner to get ip\mac addresses for all computer on the LAN. This tool scan network throught ARP and list IP, MAC, username, workgroup for every network device: http://trogonsoftware.com/trogon-mac-scanner.html
Free Windows Admin Tool Kit Click here and download it now
January 10th, 2012 9:06am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics