If it's yours, change your IP, then ARP for the original (ping may not
work). If you get a response, you have a duplicate.
If it's not yours, run Ethereal, clear your ARP cache, and then ping the
address. Before you ping, your machine will ARP. Check for duplicate ARP
replies.
If you mean as a monitoring function, where you're waiting for a 'duplicate
IP event' on the network, you'd have to watch for all ARPs on the network,
and watch for two ARP replies that come in within, say, 5 seconds for the
same IP address.
You can't necessarily just maintain an ARP table for the subnet and then
watch for one of the MAC addresses to change, since that can happen on its
own. (What happens if I replace my NIC?)
In theory, at least, if a machine has the same IP address as another, it
will only cause problems if both answer to ARP. If one answers to ARPs and
the other doesn't, no one else on the network will ever pick up the MAC
address of the machine that doesn't respond to ARPs, so even though it is
configured with a duplicate IP, it doesn't have any effect. Someone correct
me if I am wrong here.
--J
> -----Original Message-----
> From: Kalle Kula [mailto:cybersam72@xxxxxxxxxxx]
> Sent: Friday, October 19, 2001 7:01 AM
> To: ethereal-users@xxxxxxxxxxxx
> Subject: [Ethereal-users] Duplicate IP Addresses!
>
>
> Does anyone know a easy way to detect duplicate Ip Adresses?
>
> /Martin
>
> _________________________________________________________________
> Hämta MSN Explorer kostnadsfritt på http://explorer.msn.se
>
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
