In this video, we're going to discuss
duplicate addresses in our network,
specifically, duplicate MAC addresses at layer two
and duplicate IP addresses at layer three.
First, let's focus on layer two
with duplicate MAC addresses.
If you remember, a MAC address is a 12 digit number
that's written in hexadecimal format,
and it's used to uniquely identify
a network interface card on a given network.
A MAC address has 48 bits in total length for its address.
The first 24 bits or six hexadecimal digits
is going to be assigned based on the hardware manufacturer.
And the second 24 bits or six hexadecimal digits
are going to be used to uniquely identify
this particular network interface card on the network.
The MAC address is assigned on the device
when it's manufactured initially,
and this is a hardware or burnt-in physical address.
For this reason, you should not have
duplicate MAC addresses on your network
unless there's an incorrect assignment made
during the production by the manufacturer,
or if somebody in your network
begins to use a self-assigned address
known as a locally-administered address.
Now, when a self-assigned address is being used,
this can often be an indication that MAC spoofing
is being used by a client on your network.
So, what's wrong with having
duplicate MAC addresses on the network?
Well, when I think of this problem,
I think back to elementary school
in the late eighties and early nineties.
You see, when I was born,
the name Jason was pretty darn common.
This made it a little bit difficult for many of my teachers,
because they often had two or three kids
in the class named Jason.
So, when the teacher would call out Jason,
there was two or three kids who would respond,
or if the teacher got a note from Jason's mom,
the teacher then had to figure out,
which Jason should get the response,
because she didn't know which mom it was.
Now, the same thing happens in our networks.
If you have two or more devices
that respond to data requests
directly from a given MAC address,
this causes a lot of network issues.
Now, for example, if you have two devices
using the same Mac address,
your switch might mistake them for each other
and they might think they're the same device.
And so, the switch will keep updating its cam table
for the location of a single device.
So, it goes from port one to port three
to port one to port three,
and repeatedly, starts going from one port to the other
when in reality there's really two devices there.
Now, duplicate MAC addresses
can also cause network connectivity issues,
because the switch doesn't know where to send the traffic
destined for that particular MAC address,
because again, it's switching
between two or three different ports.
Now, luckily, MAC addresses are only used
in layer two networks,
so once you reach a router on your network,
the address is going to be converted
to an IP address at layer three.
So, the extent of your connectivity issues
is really going to be limited in scope.
Now, a more modern challenge that we have
is with virtual machines
and their virtual network interface cards.
Because these devices are only a series of ones and zeros,
their virtual network interface cards
have to be assigned a MAC address
by a virtual machine's hypervisor.
To ensure you don't end up with duplicate MAC addresses
caused by these virtual machines,
you need to make sure you're using a logical domain manager.
Now, a logical domain manager is used
to listen to multicast messages on the network
and keep track of all the MAC addresses that are being used.
As it does this, it identifies if there's any duplicates,
and if it is, then it will go ahead
and reassign MAC addresses for its virtual machines
to prevent duplications.
So, how can you determine if there's a duplicate MAC address
operating on your network?
First, you're going to see network connectivity issues
for two machines, and those machines
will have duplicate MAC addresses.
This is caused by the switch that continually has to go
back and forth between two ports and updating its CAM table,
because it sees the same MAC address
reporting itself on two different ports.
This will cause intermittent connectivity
for the two devices,
or one of the devices will have great connectivity
and the other one will be completely nonresponsive.
Second, you could set up a protocol analyzer
like Wireshark on your network.
Then you can look at the network traffic,
specifically the ARC traffic,
and see what IP addresses are being mapped
and reported for each MAC address.
If you see the same MAC address
being used by two different machines
or two different IP addresses,
this could indicate a duplicate MAC address
is on your network.
To prevent issues on your network
caused by duplicate MAC addresses,
you can enable port security on your devices.
This can be configured to allow a single MAC address
to be configured to one single switch port,
and then it's going to prevent any duplicate MAC addresses
from accessing the network at the same time.
Now, to identify switch ports
that are used for particular MAC address,
you can enter the show arp command on your switch.
Here's an example of running the show arp command
on a Cisco switch.
Notice, there are two matching MAC addresses in use here,
both with different IP addresses
and different physical interface ports.
One is on FastEthernet 0/3/3/4,
and the other is on FastEthernet 0/3/3/5.
This can cause conflicts or frames
that simply aren't going to be delivered
to the right devices on this switch.
Now, once you identify the devices
that are using the duplicate MAC addresses,
you can check those devices locally
to see if there's a hardware manufacturing issue
that assign the same MAC address to both devices.
Or if this is a case of MAC spoofing,
you want to make sure that you reset the MAC address
back to the burned-in physical address
or remove that device from the network completely.
If it's a hardware manufacturing issue,
you're going to need to replace the network interface card
to permanently solve this problem.
Next, let's talk about duplicate IP addresses.
A duplicate IP address is also known
as an IP Address Conflict.
This occurs when another computer on the same network
has an identical IP to another workstation
or server on that same network.
Most often this occurs when you're using
static IP address assignments for your network clients
and you didn't properly account for which IPs
were already used by other devices, or you had a typo.
If you're using DHCP and this happens,
this could be a DHCP server issue
where it didn't properly account for the IPs
that already issued out,
or it could be the case of somebody
statically assigning an IP to their client
even though the DHCP server has that IP address
assigned as part of its scope.
Now, a third reason this going to occur
is if you have a rogue DHCP server on your network,
because that rogue DHCP server
could be handing out the same IP addresses
as your official DHCP server,
and this can be happening from
a private class C address IP scope.
Now, if you have duplicate IP addresses
being used by two devices on your network,
this will cause intermittent connectivity
for both of those clients,
because both of those clients
are requesting network services,
but the routers may not know
where to send the traffic back to,
'cause both clients are using the same IP address.
To solve this, you should first check if the client
is dynamically or statically assigned an IP address.
As I said, most commonly the device
is going to be statically assigned an IP
and you're going to have a duplicate IP address issue,
because somebody typed in the wrong thing.
To check this, go to your Network Adaptor Properties
for TCP/IP version four and Windows,
and you're going to see use the following
IP address radio buttons there.
And if that's selected,
that means you're statically assigned.
If your network is supposed to use DHCP,
simply click obtain an IP address automatically instead,
and then save your changes
and the network interface card
will go out to the DHCP server
and get the dynamic assignment for an IP address
that it should use moving forward.
If you want to identify the duplicate IP addresses
on your network though,
you can start by logging into
the command line interface on your router.
In my example, I'm going to use a Cisco router
and I'm going to enter the command show arp
just like we did when searching for duplicate MAC addresses.
This time though, we're focused
on IP addresses in that first column.
Here I see two IP addresses displayed with 10.1.4.2.
The first one is located on interface FastEthernet 0/3/3/4,
and the second one is on the interface FastEthernet 0/3/3/5.
Now, that we know which interfaces
and switch ports are being used,
we can check the configurations on those individual clients
and we can ensure they're properly assigned statically
or they're configured to receive a dynamic IP address
from our network's DHCP server.