How do you find and confirm a duplicate IP address?
Show the answer
Say this first
The symptom is intermittent: a host works, drops, then works again, because other devices' ARP caches
flip between two MAC addresses. To confirm, I watch show ip arp <ip> on the gateway change MAC, look
for the Windows address conflict warning, or use arping -D or the Wireshark filter
arp.duplicate-address-detected. If someone takes the router's own address, IOS logs %IP-4-DUPADDR.
I trace both MACs to switch ports, find the device that should not have the address, and prevent repeats
with DHCP exclusions, IPAM, and DHCP snooping with DAI and IP Source Guard.
Go deeper
Confirm it
DSW1# show ip arp 10.20.0.40
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.20.0.40 0 0c4a.21d3.9e10 ARPA Vlan20
DSW1# clear ip arp 10.20.0.40
DSW1# show ip arp 10.20.0.40
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.20.0.40 0 b8ca.3a5f.0c22 ARPA Vlan20Two MAC addresses answer for one IP. Trace each one with show mac address-table address and CDP or LLDP
until you reach two access ports. On Linux, arping -D -I eth0 10.20.0.40 gets a reply if another host
holds the address.
When the conflict is with the router's own interface address, the log names the culprit:
%IP-4-DUPADDR: Duplicate address 10.20.0.1 on Vlan20, sourced by b8ca.3a5f.0c22.
Common causes
- A static IP set on a device inside the DHCP pool: printers, cameras, a test laptop.
- A cloned VM booted with the same static address.
- Someone used the gateway address as a host address.
- A rogue DHCP server handing out overlapping addresses.
Prevent it
- DHCP exclusions for static ranges, and an IPAM record for every static address.
- DHCP snooping with Dynamic ARP Inspection and IP Source Guard on access ports, so only leased or statically bound addresses are accepted.
- Conflict detection on the DHCP server. Cisco IOS DHCP pings an address twice before offering it by default; on Windows DHCP it is a setting that is off by default.
They will ask next
Does a duplicate IP always show up in the router's log?
No.
%IP-4-DUPADDRfires only when a device claims one of the router's own addresses. Two hosts fighting over a client address show up as an ARP entry that keeps changing MAC, or in a capture.What role does gratuitous ARP play?
A host sends a gratuitous ARP when its interface comes up, to announce its address and detect conflicts. It also updates everyone's ARP caches, which is exactly why the entry flips between two devices.
Traps
- Giving the victim a new address and never finding the device that took the old one.