|I'm trying to think of the software used at my place of employment, but since it's not my department, I'm not 100% sure if this is correct. I believe we use a program called Altiris to both report on PC's within our network as well as to push software to the same PC's.|
What I do know is, as a network technician in a place that uses all statically assigned IP's, it's frequently my job to chase down duplicate IP's.
When a dupe happens, it's sent to me. The first thing I do is go to the PC of the person reporting the error and have a look at the Event Viewer on their PC. It will report the dupe error as well as the MAC address of the other side of the duplicate (ie: the PC using it that doesn't have that IP assigned to it). I then go back to my desk with the MAC addy and open a network drive which holds all the reported info (from Altiris) on all PC's in our network.
There is a folder for each PC/laptop within our domain. I search 'inside' each folder and the files held within for the MAC address. The actual files within the folders have as content the IP address, hostname etc of said PC/laptop. It's worth noting that doing this search via Windows is about 1000 times slower than if the info were on a linux/UNIX based server and I could use "grep" within a script to do the same search. Anyhow, I go for coffee while "windoze" performs it's search of the hundreds of folders and files therein.
If I'm lucky, I find it and discover the person responsible for dishing out IP's just forgot to make note of it in the DNS database file and mistakenly reassigned the same IP to someone else.
However, that's usually not the case and I then have to start searching the MAC address tables of our managed switches until I find the offending party. I then remotely disable the port that person is plugged in to and await the inevitable "I have no connectivity" call and VOILA! I know who's using an IP they didn't request through proper channels. Once they have requested an IP as per procedure (it's almost always an IT person cheating and grabbing an IP they figure isn't in use so yes, I love shutting them down and then giving them an earful about messing with IP's and my network...lol), I then reenable the port on the switch and life goes on as it should.