Duplicate IP address

Question

Level 1

15 points

Duplicate IP address

I am getting a duplicate IP address error message in system.log quite often. I've pasted it below. This is occurring on multiple Macs at the office. The address that is in the message is the address of the computer itself. It doesn't matter if the network is configured DHCP or manual. Still get the same message, with different IP addresses being report of course. From another machine I can ping 10.1.3.1 and the correct Mac responds. I disconnect the network to 10.1.3.1 and ping and there is no response. The network never goes down, which does happen when you really have duplicate IPs on the network.
The switch that we are connecting to is a Cisco 6509 with VLANs on it. The VLANs are separate and don't interact. The net mask for the network is class A.
Everything I have search for on the net says "you have another computer with the same IP" but I KNOW that is not the case.
Anyone have any ideas?

12/9/09 8:35:13 AM kernel en0 duplicate IP address 10.1.3.1 sent from address 00:17:f2:01:ed:08
12/9/09 8:35:13 AM kernel en0 duplicate IP address 10.1.3.1 sent from address 00:17:f2:01:ed:08
12/9/09 8:35:13 AM kernel en0 duplicate IP address 10.1.3.1 sent from address 00:17:f2:01:ed:08
12/9/09 8:35:13 AM kernel en0 duplicate IP address 10.1.3.1 sent from address 00:17:f2:01:ed:08
12/9/09 8:35:13 AM kernel en0 duplicate IP address 10.1.3.1 sent from address 00:17:f2:01:ed:08

Mac Pro 2.66 dual, Mac OS X (10.6.2)

Posted on Dec 9, 2009 6:46 AM

Reply

Answer 1

etresoft

Level 8

46,720 points

Dec 9, 2009 10:52 AM in response to Alan Ordway

Perhaps there is a routing problem in the network that is causing the packets to get duplicated and sent back out. It seems that the UNIX underpinnings of MacOS X give users networking abilities that perhaps they shouldn't have. I have a 3G USB modem that only works with my VPN if Parallels is installed - just as an example 🙂

I am disinclined to think that the Cisco switch it self is causing it, although that is possible. There may be some funky software or setting on some machine on that network that is causing it. Does someone have internet sharing turned on perhaps?

Reply

Answer 2

Camelot

Level 9

54,339 points

Dec 9, 2009 8:37 PM in response to Alan Ordway

The address that is in the message is the address of the computer itself

Do you mean the MAC address (00:17:f2:01:ed:08) or the IP address?

If you mean the IP address, then that's not relevant, and it's not surprising that the IP address matches this machine. What's more relevant is the MAC address since that identifies the piece of hardware that's trying to use this IP address.

In other words, how I interpret this message is "hey! I'm 10.1.3.1 and there's some other device on the network at MAC address 00:17:f2:01:ed:08 who's trying to take over my IP!).

Fortunately the Cisco switch should make it pretty easy to trace the rogue device - it will be able to tell you (or, at least, the network admin) which port on the switch that device is connected from. From there a simple(?) cable trace will highlight the culprit;.

Reply

Answer 3

Alan Ordway Author

Level 1

15 points

Dec 10, 2009 6:18 AM in response to Camelot

The MAC address in the error message is the MAC address of the machine reporting the error. Normally that MAC address in the error message is the other machine on the network that is trying to use the same IP address.

ifconfig en0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::217:f2ff:fe01:ed08%en0 prefixlen 64 scopeid 0x4
inet 10.1.3.1 netmask 0xff000000 broadcast 10.255.255.255
ether 00:17:f2:01:ed:08
media: autoselect (1000baseT <full-duplex,flow-control>) status: active
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control>

Message was edited by: Alan Ordway

Message was edited by: Alan Ordway

Reply

Answer 4

Camelot

Level 9

54,339 points

Dec 10, 2009 4:19 PM in response to Alan Ordway

The MAC address in the error message is the MAC address of the machine reporting the error

OK, it was a question that needed to be asked, since it wasn't clear whether you were referring to the MAC or IP address.

That said, I'm all out of ideas. I've never seen a case where the Mac complains of its own address being used by itself. I'd lean towards the switch configuration, but it's a long shot.

Reply