IP Address Conflict: Detection and Resolution

What Is an IP Address Conflict?

An IP address conflict occurs when two devices on the same network segment are assigned the same IP address. Since routers and switches use IP addresses to direct traffic, two devices sharing an address creates ambiguity: incoming packets may be delivered to the wrong device, dropped, or cause one or both devices to go offline intermittently.

IP conflicts are more common than most administrators expect, particularly in networks that mix DHCP-assigned addresses with manually configured static IPs.

Symptoms of IP Conflicts

The symptoms of an IP conflict depend on the operating system and network equipment involved:

# Linux: check kernel conflict detection in logs
sudo dmesg | grep -i "duplicate\|conflict\|arp"
sudo journalctl -k | grep -i arp

# macOS: check system logs
log show --last 1h --predicate 'eventMessage contains "conflict"'

ARP Table Inspection

The ARP (Address Resolution Protocol) table maps IP addresses to MAC addresses. Two identical IP entries with different MAC addresses is definitive proof of a conflict.

# View ARP table (Linux)
arp -n
ip neigh show

# View ARP table (macOS)
arp -a

# View ARP table (Windows)
arp -a

# Example conflict in ARP table:
# 192.168.1.50  08:00:27:11:22:33  (device A)
# 192.168.1.50  08:00:27:aa:bb:cc  (device B — same IP, different MAC)

Use arping to actively probe for duplicate IP responses:

# Install arping if needed
sudo apt install arping       # Debian/Ubuntu
sudo brew install arping      # macOS

# Probe for all devices claiming a specific IP
sudo arping -D -I eth0 192.168.1.50
# -D = duplicate address detection mode
# Exit code 1 means a conflict was found

# Send multiple probes
sudo arping -c 5 -I eth0 192.168.1.50
# If you see two different MAC addresses responding, there's a conflict

Finding the Conflicting Device

Once you know the conflicting IP, use the MAC address to identify the device.

# Step 1: Get the MAC address from ARP table
arp -n | grep 192.168.1.50

# Step 2: Look up MAC vendor (first 3 octets = OUI)
# Online: https://macvendors.com
# Command line:
curl "https://api.macvendors.com/08:00:27"
# Returns: "PCS Systemtechnik GmbH" (VirtualBox)

# Step 3: Search your DHCP server's lease table for that MAC
# ISC DHCP:
cat /var/lib/dhcp/dhcpd.leases | grep -A5 "08:00:27:aa:bb:cc"

# dnsmasq:
cat /var/lib/misc/dnsmasq.leases | grep "08:00:27:aa:bb:cc"

For switches with management interfaces, use the MAC address table to find the physical port:

# Cisco IOS
show mac address-table address 0800.27aa.bbcc

# This shows which switch port the MAC is connected to
# Physical port identification leads you to the device

DHCP Lease Management

Most IP conflicts arise when a device with a static IP is assigned the same address by DHCP. Proper DHCP lease management prevents this.

# ISC DHCP Server: reserve IP for a MAC address
# Add to /etc/dhcp/dhcpd.conf:
host mydevice {
    hardware ethernet 08:00:27:11:22:33;
    fixed-address 192.168.1.50;
}

# dnsmasq: DHCP reservation
# Add to /etc/dnsmasq.conf:
dhcp-host=08:00:27:11:22:33,192.168.1.50,mydevice

# View active DHCP leases (ISC DHCP)
sudo cat /var/lib/dhcp/dhcpd.leases

# Revoke a specific lease
omshell   # ISC DHCP management shell
# > connect
# > new lease
# > set ip-address = 192.168.1.50
# > open
# > remove

In the DHCP server's address pool, exclude addresses reserved for static assignment:

# ISC DHCP example: reserve 192.168.1.1-99 for static, pool 100-200 for DHCP
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
}

Static IP Planning

Structure your IP address space to avoid conflicts:

Document every static IP assignment in a spreadsheet or IPAM tool. Update it immediately when adding or removing devices.

IPAM Tools

IP Address Management (IPAM) tools automate the tracking of IP assignments and can alert on conflicts.

# Angry IP Scanner (command line mode)
ipscan 192.168.1.0/24 -o results.csv

# nmap: scan subnet and get MAC addresses
sudo nmap -sn 192.168.1.0/24
# Shows IP + MAC for all responding hosts
# Compare against your documented IP plan

Preventing Future Conflicts

1. DHCP reservations over static IPs: Instead of configuring static IPs on individual devices, use DHCP reservations. The device still gets a predictable IP, but DHCP controls assignment.

2. Separate VLAN per device class: Isolate servers, IoT devices, and client endpoints in different subnets. Conflicts cannot cross VLANs.

3. Enable ARP inspection on managed switches: Dynamic ARP Inspection (DAI) validates ARP packets against a DHCP snooping binding table and drops suspicious packets.

# Cisco: enable DAI on VLAN 10
ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10

1. Regular subnet audits: Run weekly subnet scans with nmap and compare against your IPAM database to catch unauthorized or duplicate devices early.