-: Duplicate addresses. 2 2
In this video, we're going to discuss duplicate addresses 3 3
in our network, specifically duplicate MAC addresses 4 4
at layer two and duplicate IP addresses at layer three. 5 5
First let's focus on layer two with duplicate MAC addresses. 6 6
If you remember a MAC address is a 12 digit number 7 7
that's written in hexadecimal format, 8 8
and it's used to uniquely identify a network interface card 9 9
on a given network. 10 10
A MAC address has 48 bits in total length for its address. 11 11
The first 24 bits, or six hexadecimal digits, 12 12
is going to be assigned based on the hardware manufacturer. 13 13
And the second 24 bits, or six hexadecimal digits, 14 14
are going to be used to uniquely identify 15 15
this particular network interface card on the network. 16 16
The MAC address is assigned on the device 17 17
when it's manufactured initially, 18 18
and this is a hardware or burnt in physical address. 19 19
For this reason, 20 20
you should not have duplicate MAC addresses on your network, 21 21
unless there's an incorrect assignment 22 22
made during the production by the manufacturer, 23 23
or if somebody in your network 24 24
begins to use a self assigned address 25 25
known as a locally administered address. 26 26
Now, when a self assigned address is being used, 27 27
this can often be an indication that MAC spoofing 28 28
is being used by a client on your network. 29 29
So what's wrong with having duplicate MAC addresses 30 30
on the network? 31 31
Well, when I think of this problem, 32 32
I think back to elementary school in the late eighties 33 33
and early nineties. 34 34
You see when I was born, 35 35
the name Jason was pretty darn common. 36 36
This made it a little bit difficult for many of my teachers 37 37
because they often had two or three kids 38 38
in the class named Jason. 39 39
So when the teacher would call out Jason, 40 40
there was two or three kids who would respond. 41 41
Or if the teacher got a note from Jason's mom, 42 42
the teacher then had to figure out which Jason 43 43
should get the response 44 44
because she didn't know which mom it was. 45 45
Now, the same thing happens in our networks. 46 46
If you have two or more devices 47 47
that respond to data requests 48 48
directly from a given MAC address, 49 49
this causes a lot of network issues. 50 50
Now for example, if you have two devices 51 51
using the same Mac address, 52 52
your switch might mistake them for each other. 53 53
And they might think they're the same device, 54 54
and so the switch will keep updating its CAM table 55 55
for the location of a single device. 56 56
So it goes from port one to port three, 57 57
to port one to port three 58 58
and repeatedly starts going from one port to the other, 59 59
when in reality, there's really two devices there. 60 60
Now duplicate MAC addresses 61 61
can also cause network conductivity issues 62 62
because the switch doesn't know where to send the traffic 63 63
destined for that particular MAC address. 64 64
Because again, it's switching between two 65 65
or three different ports. 66 66
Now, luckily MAC addresses are only used 67 67
in layer two networks. 68 68
So once you reach a router in your network, 69 69
the address is going to be converted to an IP address 70 70
at layer three, 71 71
so the extent of your connectivity issues 72 72
is really going to be limited in scope. 73 73
Now a more modern challenge that we have 74 74
is with virtual machines 75 75
and their virtual network interface cards, 76 76
because these devices are only a series of ones and zeros, 77 77
the virtual network interface cards 78 78
have to be assigned a MAC address 79 79
by a virtual machines hypervisor. 80 80
To ensure you don't end up with duplicate MAC addresses 81 81
caused by these virtual machines, 82 82
you need to make sure you're using a Logical Domain Manager. 83 83
Now, a Logical Domain Manager 84 84
is used to listen to multicast messages on the network 85 85
and keep track of all the MAC addresses that are being used. 86 86
As it does this, it identifies if there's any duplicates 87 87
and if it is, 88 88
then it will go ahead and reassign MAC addresses 89 89
for its virtual machines to prevent duplications. 90 90
So how can you determine if there's a duplicate MAC address 91 91
operating on your network? 92 92
First, you're going to see network conductivity issues 93 93
for two machines, 94 94
and those machines will have duplicate MAC addresses. 95 95
This is caused by the switch 96 96
that continually has to go back and forth between two ports 97 97
and updating its CAM table 98 98
because it sees the same MAC address reporting itself 99 99
on two different ports. 100 100
This will cause intermittent connectivity 101 101
for the two devices 102 102
or one of the devices will have great connectivity 103 103
and the other one will be completely non-responsive. 104 104
Second, you could set up a protocol analyzer like Wireshark 105 105
on your network. 106 106
Then you can look at the network traffic, 107 107
specifically the ARP traffic and see what IP addresses 108 108
are being mapped and reported for each MAC address. 109 109
If you see the same AMC address being used 110 110
by two different machines or two different IP addresses, 111 111
this could indicate a duplicate MAC address 112 112
is on your network. 113 113
To prevent issues on your network 114 114
caused by duplicate MAC addresses, 115 115
you can enable port security on your devices. 116 116
This can be configured to allow a single MAC address 117 117
to be configured to one single switch port, 118 118
and then it's going to prevent any duplicate MAC addresses 119 119
from accessing the network at the same time. 120 120
Now, to identify switch boards that are used 121 121
for particular MAC address, 122 122
you can editor the show ARP command on your switch. 123 123
Here's an example of running the show ARP command 124 124
on a Cisco switch. 125 125
Notice there are two matching MAC addresses in use here, 126 126
both with different IP addresses 127 127
and different physical interface ports. 128 128
One is on fast ethernet 0/3/3/4 129 129
and the other is on fast ethernet 0/3/3/5. 130 130
This can cause conflicts or frames 131 131
that simply aren't going to be delivered to the right devices 132 132
on this switch. 133 133
Now, once you identify the devices 134 134
that are using the duplicate MAC addresses, 135 135
you can check those devices locally 136 136
to see if there's a hardware manufacturing issue 137 137
that assigned the same MAC address to both devices, 138 138
or, if this is the case in MAC spoofing, 139 139
you want to make sure that you reset the MAC address 140 140
back to the burned in physical address 141 141
or remove that device from the network completely. 142 142
If it's a hardware manufacturing issue, 143 143
you're going to need to replace the network interface card 144 144
to permanently solve this problem. 145 145
Next, let's talk about duplicate IP addresses. 146 146
A duplicate IP address is also known 147 147
as an IP Address Conflict. 148 148
This occurs when another computer on the same network 149 149
has an identical IP to another workstation or server 150 150
on that same network. 151 151
Most often this occurs when you're using static IP address 152 152
assignments for your network clients 153 153
and you didn't properly account for which IPs 154 154
were already used by other devices, or you had a typo. 155 155
If you're using DHCP in this happens, 156 156
this could be a DHCP server issue 157 157
where it didn't properly account 158 158
for the IPs it already issued out, 159 159
or it could be the case of somebody statically assigning 160 160
an IP to their client, 161 161
even though the DHCP server has that IP address assigned 162 162
as part of its scope. 163 163
Now, a third reason this can occur 164 164
is if you have a rogue DHCP server on your network, 165 165
because that rogue DHCP server could be handing out 166 166
the same IP addresses as your official DHCP server, 167 167
and this can be happening 168 168
from a private class C address IP scope. 169 169
Now, if you have duplicate IP addresses 170 170
being used by two devices on your network, 171 171
this'll cause intermittent connectivity 172 172
for both of those clients, 173 173
because both of those clients 174 174
are requesting network services, 175 175
but the routers may not know where to send the traffic 176 176
back to 'cause both clients are using the same IP address. 177 177
To solve this, you should first check if the client 178 178
is dynamically or statically assigned an IP address. 179 179
As I said, most commonly, devices can be statically assigned 180 180
an IP, and you're going to have a duplicate IP address issue 181 181
because somebody typed in the wrong thing. 182 182
To check this, go to your network adapter properties 183 183
for TCP/IP version four in Windows 184 184
and you're going to see, 185 185
use the following IP address radio buttons there, 186 186
and if that's selected, 187 187
that means you're statically assigned. 188 188
If your network is supposed to use DHCP, 189 189
simply click, obtain an IP address automatically instead 190 190
and then save your changes, 191 191
and the network interface card will go out 192 192
to the DHCP server and get the dynamic assignment 193 193
for an IP address that it should use moving forward. 194 194
If you want to identify the duplicate IP addresses 195 195
on your network though, 196 196
you can start by logging into the command line interface 197 197
on your router. 198 198
In my example, I'm going to use a Cisco router 199 199
and I'm going to enter the command show ARP, 200 200
just like we did when searching for duplicate MAC addresses. 201 201
This time though, 202 202
we're focused on IP addresses in that first column. 203 203
Here, I see two IP addresses displayed with 10.1.4.2. 204 204
The first one is located on interface, 205 205
fast ethernet 0/3/3/4 206 206
and the second one is on the interface 207 207
fast ethernet 0/3/3/5. 208 208
Now that we know which interfaces and switch ports 209 209
are being used, 210 210
we can check the configurations on those individual clients 211 211
and we can ensure they're properly assigned statically 212 212
or they're configured to receive a dynamic IP address 213 213
from our network's DHCP server. 214 214
(static vibrating)