Ethereal-users: RE: [Ethereal-users] Duplicate IP Addresses!

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Parker <jparker@xxxxxxxxxxxx>
Date: Fri, 19 Oct 2001 09:57:40 -0400
> If it's not yours, run Ethereal, clear your ARP cache, and 
> then ping the address.  Before you ping, your machine will 
> ARP.  Check for duplicate ARP replies.

Excellent advice if you know the address that has been
compromised.  The question of detecting that someone
might be using some (unknown) IP address is an interesting
one.

I would gladly put up with an application that has some
false positives when you change you NIC card if it

	1) Caught all duplicates used within a configurable
	   window (this should allow you to reuse via DHCP)
	2) Only told me once about each event

This isn't rocket science, but would make a nice application.
Perhaps one of the academics running a networking class
could use this as an assignment and post the best solution?

- jeff parker
- axiowave networks