Tracking down a duplicate IP address on a live VLAN

A duplicate IP address on a live VLAN causes connectivity failures, host confusion, and unpredictable packet delivery. The device that claims the address first wins; the second device either fails to configure its interface or loses connectivity intermittently. Finding the culprit requires systematic investigation across DHCP, ARP, and device logs. This guide walks you through proven troubleshooting methods.

Recognize the symptoms

Duplicate IP conflicts typically announce themselves through one or more of these signs: a host cannot obtain or maintain an IP address; a host receives an 'IP address already in use' message; a device loses connectivity moments after joining the network; or ping responses come from multiple MAC addresses for the same IP. In DHCP environments, the DHCP server may log conflicts or mark addresses as abandoned.

Check DHCP logs and scope status

Start with your DHCP server. Most DHCP implementations log address conflicts, declined offers, and release events. Look for entries showing the same IP offered to different MAC addresses or a client declining an address because it detected a conflict.

# Windows DHCP Server event log (Event Viewer)
Event ID 1050: DHCP server detected a conflict for IP address
Event ID 1051: DHCP server encountered an error

# ISC DHCP (Linux/Unix) syslog
grep 'DHCPDISCOVER\|DHCPDECLINE\|duplicate' /var/log/syslog

# Cisco IOS DHCP
show ip dhcp conflict

If your DHCP server supports ping-before-offer, verify it is enabled. This feature reduces but does not eliminate conflicts, because a silent or powered-off device will not respond to the ping.

Use ARP to map IPs to MAC addresses

ARP (Address Resolution Protocol) is your primary detective tool. Query your network devices and a central location like your default gateway or a monitoring host to see which MAC addresses claim the disputed IP.

# From a Linux or macOS host on the same VLAN
arp -a | grep <suspected-ip>

# From a Windows host
arp -a | findstr <suspected-ip>

# From a Cisco switch (if the IP is on a routed interface)
show arp | include <suspected-ip>

# From a Linux router or monitoring host
ip neigh show | grep <suspected-ip>
arping -c 5 <suspected-ip>

If you see multiple MAC addresses responding to the same IP, you have confirmed the duplicate. Note both MAC addresses and their vendor prefixes (the first three octets). Cross-reference these against your device inventory, DHCP leases, and network documentation.

Isolate and identify the offending devices

With MAC addresses in hand, locate the physical devices. Check switch port MAC address tables, DHCP lease files, and device management platforms.

# On a Cisco switch, find which port has the MAC
show mac address-table | include <mac-address>

# On a Linux host, check DHCP leases
cat /var/lib/dhcp/dhclient.leases
cat /var/lib/dhcpcd/*.lease

# Query your DHCP server for lease records
grep <mac-address> /var/lib/dhcp/dhcpd.leases

Once you identify the switch ports, visit those locations physically or via remote access to confirm device identity, serial numbers, and hostnames. One device is usually misconfigured with a static IP; the other is requesting a DHCP address that collides with it.

Resolve the conflict

• →Assign the static-IP device a different address outside the DHCP pool, or move it into the pool with a DHCP reservation keyed to its MAC address.
• →Exclude the static IP from the DHCP scope to prevent future collisions.
• →Release and renew the DHCP client to force it to request a new address.
• →Power-cycle both devices after making changes to clear stale ARP entries.
• →Verify connectivity and confirm ARP shows only one MAC per IP.