As network operators, we often face the daunting task of troubleshooting duplicate IP addresses on the network. This is an age-old issue that can turn into a tedious and time-consuming process if not handled efficiently. Traditional troubleshooting methods involve pinging the IP address and checking the ARP cache on the switch. However, Arista switches, with their Linux foundations, offer a more streamlined approach - the use of the "arping" command.
Arping is a Linux command that can be used to discover hosts on a computer network. It accomplishes this by sending ARP (Address Resolution Protocol) requests to the specified subnet and listens for responses. This allows you to see if you've learned multiple MAC addresses for the same IP address, indicating a duplicate IP on your network.
The command accepts several arguments to modify its behavior:
- -b : keeps broadcasting, and doesn't go unicast
- -c count : specifies the number of packets to send
- -I device : identifies which ethernet device to use
- -s source : sets the source IP address
This command is accessed in the bash shell on your Arista EOS host. To get into bash, enter the command "bash" and hit enter on the standard EOS command line.
Arping in Action: Troubleshooting Duplicate IPs
Now consider a situation where you have three conflicting IPs. Running the command
arping -b -c 3 -I vlan1 -s 192.168.30.131 192.168.30.2, you would receive unicast replies from the IP address 192.168.30.2, each with different MAC addresses. The multiple MAC addresses for a single IP address confirms the presence of duplicate IPs on the network. It might look something like this.
[operator@Arista-720XP-CS1 ~]$ arping -b -c 3 -I vlan1 -s 192.168.30.131 192.168.30.2
ARPING 192.168.30.2 from 192.168.30.131 vlan1
Unicast reply from 192.168.30.2 [E8:98:6D:1C:6D:00] 3.873ms
Unicast reply from 192.168.30.2 [B4:0C:25:5B:F4:00] 4.702ms
Unicast reply from 192.168.30.2 [98:5A:EB:DF:04:89] 4.747ms
Unicast reply from 192.168.30.2 [E8:98:6D:1C:6D:00] 4.529ms
Unicast reply from 192.168.30.2 [B4:0C:25:5B:F4:00] 4.749ms
Unicast reply from 192.168.30.2 [98:5A:EB:DF:04:89] 4.965ms
Unicast reply from 192.168.30.2 [E8:98:6D:1C:6D:00] 3.795ms
Unicast reply from 192.168.30.2 [B4:0C:25:5B:F4:00] 4.144ms
Unicast reply from 192.168.30.2 [98:5A:EB:DF:04:89] 4.519ms
Sent 3 probes (3 broadcast(s))
Received 9 response(s)
In a healthy network situation, you should only see one MAC address answering up for one IP address. But in our scenario, there are three MAC addresses responding for the same IP. This raises a red flag, and further investigation is warranted to resolve the conflict.
Resolving the Issue
Once you've identified the problem, the next step is to remove the duplicate addresses. After cleaning up the duplicates, running the same arping command again should yield unicast replies from the same IP address but this time, all from a single MAC address.
The output of the Arping command after removing the duplicate IP address should look something like this:
ARPING 192.168.30.2 from 192.168.30.131 vlan1 Unicast reply from 192.168.30.2[98:5A:EB:DF:04:89] 5.201ms Unicast reply from 192.168.30.2 [98:5A:EB:DF:04:89] 3.969msUnicast reply from 192.168.30.2 [98:5A:EB:DF:04:89] 5.258ms Sent 3 probes (3broadcast(s)) Received 3 response(s)
In conclusion, Arping proves to be an invaluable tool for network operators in troubleshooting and resolving duplicate IP issues on the network. By harnessing the power of Linux and Arista switches, we can make our networks more robust, efficient, and free of conflicts.
WAN Dynamics works with Arista technologies often and can help with this and others if you need them. Reach out to us at the number or Contact Us link below to get in touch.
For more Arista related content, see some of our other blog posts here: