How to detect IP address conflicts in Linux

Last updated on September 5, 2020 by Dan Nanni

IP addresses (IPv4) are a scarce resource that is shared by different users and devices. Having an IP address conflict means that there are more than one network device or computer that claims the same IP address. IP address conflict may occur when a DHCP server has assigned an IP address to one computer, and the same IP address happens to be statically assigned to another network device by someone.

IP address conflict can also happen when there are more than one DHCP server (typically built in a router) hooked up to the local network, autonomously giving out IP addresses from the same subnet. If you are having flaky network connectivity, and suspect it is due to IP address conflicts, you can use a tool called arp-scan to detect IP address conflicts in Linux.

Detect IP Address Conflicts with arp-scan

arp-scan sends out ARP request packets on local network, and collect (IP address, Ethernet MAC address) pairs from received ARP responses. If there is more than one Ethernet MAC address claiming the same IP address, it means there is an IP conflict.

To install arp-scan on Ubuntu or Debian:

$ sudo apt-get install arp-scan

To install arp-scan on CentOS, Fedora or RHEL:

$ sudo yum install arp-scan

To detect IP address conflicts with arp-scan, run the following. The -I option specifies the network interface through which ARP request packets are sent out, and the -l option lets arp-scan send ARP probes to every host on the local network that is reachable via the network interface.

$ sudo arp-scan -I eth0 -l

192.168.1.10   00:1b:a9:63:a2:4c       BROTHER INDUSTRIES, LTD.
192.168.1.30   00:1e:8f:58:ec:49       CANON INC.
192.168.1.33   00:25:4b:1b:10:20       Apple, Inc
192.168.1.37   10:9a:dd:55:d7:95       Apple Inc
192.168.1.38   20:c9:d0:27:8d:56       (Unknown)
192.168.1.39   d4:85:64:4d:35:be       Hewlett Packard
192.168.1.39   00:0b:46:e4:8e:6d       Cisco (DUP: 2)
192.168.1.40   90:2b:34:18:59:c0       (Unknown)

According to the example output shown above, IP address 192.168.1.39 is in conflict, where two different MAC addresses are claiming the same IP address.

Support Xmodulo

This website is made possible by minimal ads and your gracious donation via PayPal or credit card

Please note that this article is published by Xmodulo.com under a Creative Commons Attribution-ShareAlike 3.0 Unported License. If you would like to use the whole or any part of this article, you need to cite this web page at Xmodulo.com as the original source.