Saturday, July 2, 2016

How to detect IP address conflicts in Linux

IP addresses (IPv4) are a scarce resource that is shared by different users and devices. Having an IP address conflict means that there are more than one network device or computer that claims the same IP address. IP address conflict may occur when a DHCP server has assigned an IP address to one computer, and the same IP address happens to be statically assigned to another network device by someone.
IP address conflict can also happen when there are more than one DHCP server (typically built in a router) hooked up to the local network, autonomously giving out IP addresses from the same subnet. If you are having flaky network connectivity, and suspect it is due to IP address conflicts, you can use a tool called arp-scan to detect IP address conflicts in Linux.
arp-scan sends out ARP packets on local network to collect (IP address, Ethernet MAC address). If there is more than one Ethernet MAC address claiming the same IP address, it means there is an IP conflict.
To install arp-scan on Ubuntu or Debian:
$ sudo apt-get install arp-scan
To install arp-scan on CentOS, Fedora or Redhat:
$ sudo yum install arp-scan
To detect IP address conflicts with arp-scan, run the following.
$ sudo arp-scan -I eth0 -l   00:1b:a9:63:a2:4c       BROTHER INDUSTRIES, LTD.   00:1e:8f:58:ec:49       CANON INC.   00:25:4b:1b:10:20       Apple, Inc   10:9a:dd:55:d7:95       Apple Inc   20:c9:d0:27:8d:56       (Unknown)   d4:85:64:4d:35:be       Hewlett Packard   00:0b:46:e4:8e:6d       Cisco (DUP: 2)   90:2b:34:18:59:c0       (Unknown)
According to the example output shown above, IP address is in conflict, where two different MAC addresses are claiming the same IP address.

No comments:

Post a Comment