Hunting Duplicate IP Addresses Using "Arping" on Arista Switches

Posted by Kevin Giusti on June 26, 2023

As network operators, we often face the daunting task of troubleshooting duplicate IP addresses on the network. This is an age-old issue that can turn into a tedious and time-consuming process if not handled efficiently. Traditional troubleshooting methods involve pinging the IP address and checking the ARP cache on the switch. However, Arista switches, with their Linux foundations, offer a more streamlined approach - the use of the "arping" command.

Understanding Arping

Arping is a Linux command that can be used to discover hosts on a computer network. It accomplishes this by sending ARP (Address Resolution Protocol) requests to the specified subnet and listens for responses. This allows you to see if you've learned multiple MAC addresses for the same IP address, indicating a duplicate IP on your network.

The command accepts several arguments to modify its behavior:

  • -b : keeps broadcasting, and doesn't go unicast
  • -c count : specifies the number of packets to send
  • -I device : identifies which ethernet device to use
  • -s source : sets the source IP address

This command is accessed in the bash shell on your Arista EOS host. To get into bash, enter the command "bash" and hit enter on the standard EOS command line.

Arping in Action: Troubleshooting Duplicate IPs

Now consider a situation where you have three conflicting IPs. Running the command arping -b -c 3 -I vlan1 -s, you would receive unicast replies from the IP address, each with different MAC addresses. The multiple MAC addresses for a single IP address confirms the presence of duplicate IPs on the network. It might look something like this.

[operator@Arista-720XP-CS1 ~]$ arping -b -c 3 -I vlan1 -s
ARPING from vlan1
Unicast reply from [E8:98:6D:1C:6D:00] 3.873ms
Unicast reply from [B4:0C:25:5B:F4:00] 4.702ms
Unicast reply from [98:5A:EB:DF:04:89] 4.747ms
Unicast reply from [E8:98:6D:1C:6D:00] 4.529ms
Unicast reply from [B4:0C:25:5B:F4:00] 4.749ms
Unicast reply from [98:5A:EB:DF:04:89] 4.965ms
Unicast reply from [E8:98:6D:1C:6D:00] 3.795ms
Unicast reply from [B4:0C:25:5B:F4:00] 4.144ms
Unicast reply from [98:5A:EB:DF:04:89] 4.519ms
Sent 3 probes (3 broadcast(s))
Received 9 response(s)

In a healthy network situation, you should only see one MAC address answering up for one IP address. But in our scenario, there are three MAC addresses responding for the same IP. This raises a red flag, and further investigation is warranted to resolve the conflict.

Resolving the Issue

Once you've identified the problem, the next step is to remove the duplicate addresses. After cleaning up the duplicates, running the same arping command again should yield unicast replies from the same IP address but this time, all from a single MAC address.

The output of the Arping command after removing the duplicate IP address should look something like this:

ARPING from vlan1 Unicast reply from[98:5A:EB:DF:04:89] 5.201ms Unicast reply from [98:5A:EB:DF:04:89] 3.969msUnicast reply from [98:5A:EB:DF:04:89] 5.258ms Sent 3 probes (3broadcast(s)) Received 3 response(s)

Wrapping Up

In conclusion, Arping proves to be an invaluable tool for network operators in troubleshooting and resolving duplicate IP issues on the network. By harnessing the power of Linux and Arista switches, we can make our networks more robust, efficient, and free of conflicts.

WAN Dynamics works with Arista technologies often and can help with this and others if you need them. Reach out to us at the number or Contact Us link below to get in touch.

For more Arista related content, see some of our other blog posts here:

WAN Dynamics Works With Arista for WAN Routing System

Remote Packet Capture over SSH on Arista EOS

Arista Tips & Tricks: Connecting to Arista switches via SSH Key Based Authentication

Three Features in Arista EOS That You Need to Know About

WAN Dynamics is One of Five Arista Certified Services Partners in the World