How to locate an unauthorised duplicate IP?

October 26, 2010 at 17:31:39
Specs: Windows XP
Dear Sir,

How do I trace or pinpoint the location of the system on the same LAN that had stolen another user's/server's IP?

See More: How to locate an unauthorised duplicate IP?

Report •

October 27, 2010 at 07:44:40
That depends on a few things.

If it's a small network, you go around to each computer, open a command prompt window (Start >> Run >> type cmd and hit Enter) and run the following command:

ipconfig /all

This displays all TCP/IP settings including the address.

If it's a larger environment or you have it well documented you could look on the PC that's supposed to have that IP. Check in it's Event Viewer. Find the duplicate IP error and read the details. It will list the MAC address of the computer that has that IP now (the one the error was caused by).

When we send out PC's to staff members it lists the following info for each PC:

MAC address (of NIC)
location (ie: office #)
IP address

This way if I get a dupe error, I do as I said above to find out the MAC address. I then search the MAC address in our staff PC database and voila, I know where to go to fix the issue.

If it's a larger environment and you don't have it documented - then you get to go around computer by computer checking IP's from the command prompt and you learn a valuable lesson and do the documentation as you go from PC to PC looking for the dupe.

If you have it documented, but don't have the MAC address in the documention, as per my last paragraph only this time, you make note of the MAC address that appears when you do the ipconfig /all command and add that info to the appropriate PC documentation.

Just FYI, doing the documentation can be a PITA but, as you can see, it can also save you a LOT of time later on which is why we do it.

It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.

***William Henley***

Report •

October 27, 2010 at 07:57:10
if you have managed switches you can trace to the connecting port the mac address

Report •

Related Solutions

Ask Question