Question : IP Conflict Message

Dear Sir,

We have a LAN of around 100 Desktop Windows Client and some Linux , Unix , Windows Servers . Yesterday all of sudden we got message of their respective  IP getting Conflict at all our Computers . We tried to identify the problem but could not find anything . But surprisingly after 15 minutes the problem got over itself and no IP conflict message was there .

Sir , kindly guide me about the cause of this problem . Is it due to some Virus or any thing else . Also pl guide me that in future how to protect  against such problems .

Rgds
B Mittal

Answer : IP Conflict Message

Duplicate IP warnings are generated when a client is bringing up an IP interface and first sends an ARP request for it's own IP to make sure it's not already in use...

Without knowing more about the problem, my two best guesses are:

1. Rogue or haywire DHCP server passing out leases for IPs that are already assigned.

2. Someone (idiotic and/or malicious user) or something (malware of some kind) attempting to implement an ARP spoof attack, which might cause a single machine to answer *all* ARP requests on the local subnet...

Given that the problem disappeared quickly, I'm leaning towards #2 (probably an idiotic/malicious user, since malware doesn't tend to give up so easily).

If I'm right, the solution is to fire the moron who thinks it's OK to screw with your network.

Cheers,
-Jon