Check out some similar questions!

Flintstones1962 · Jun 22, 2006, 04:05 AM

Hello,
I've a LAN with a DC, it seems that someone has changed the IP address of his computer to be static, and it seems also that he assigned an IP address like the server one 192.168.123.2.
The problem is that, I do receive an error message on the server console stating that there's an IP conflict, and in the Log file I can't see the name of the computer also ( only tha MAC address )??

Is there any way to find out which computer is causing this problem instead of visiting more than 150 computers personally ?

Greetings

Curlyben · Jun 22, 2006, 04:21 AM

If you know the MAC address of the conflicting IP then you could always use the ARP command and reset it to a different IP.
Then have a look in the DHCP address leases to find the MAC/IP you've changed to find the specific computer. The MAC address is the unique ID.
Then grab your cattle prod and re-educate the luser in correct use of static IP addresses ;)

Curlyben · Jun 22, 2006, 04:34 AM

Hehehe Nice one NK

The ARP conmmand you want to run is

Code:

arp -s 111.222.333.444 aa-bb-cc-dd-ee-ff

This will make MAC address aa-bb-cc-dd-ee-ff have the static IP of 111.222.333.444

Flintstones1962 · Jun 22, 2006, 04:45 AM

Thanks, I did it and waiting to see the result...

Greetings

ScottGem · Jun 22, 2006, 06:31 AM

For future reference, I would do an inventory of all PCs. List at least the Make, Model, Serial No, MAC, Computer name and primary user of each PC attached to your network.

You can do this fairly easily using Belarc.com.

cajalat · Jun 28, 2006, 10:03 AM

I don't recommend messing with the ARP cache entry as this is only hiding the real problem. It is a temporary solution that will likely come back to bite you especially if the user now needs to connect to the server in question. If this is a network with 150 PC's chances are you're using an enterprise grade switch(s) on your network. If you have access to the switches then you can locate the exact port that the PC with the rouge IP is connected to using the MAC address. All manageble switches maintain a database of MAC to Port mappings which you can use to identify the device.

Do you know what kind of switches you have?

Casey