1 1 00:00:00,520 --> 00:00:02,090 Duplicate addresses. 2 2 00:00:02,090 --> 00:00:04,630 In this video, we're going to discuss duplicate addresses 3 3 00:00:04,630 --> 00:00:07,470 in our network, specifically duplicate MAC addresses 4 4 00:00:07,470 --> 00:00:11,050 at layer two and duplicate IP addresses at layer three. 5 5 00:00:11,050 --> 00:00:14,470 First let's focus on layer two with duplicate MAC addresses. 6 6 00:00:14,470 --> 00:00:17,570 If you remember a MAC address is a 12 digit number 7 7 00:00:17,570 --> 00:00:19,270 that's written in hexadecimal format, 8 8 00:00:19,270 --> 00:00:22,000 and it's used to uniquely identify a network interface card 9 9 00:00:22,000 --> 00:00:23,300 on a given network. 10 10 00:00:23,300 --> 00:00:26,690 A MAC address has 48 bits in total length for its address. 11 11 00:00:26,690 --> 00:00:29,780 The first 24 bits, or six hexadecimal digits, 12 12 00:00:29,780 --> 00:00:32,270 is going to be assigned based on the hardware manufacturer. 13 13 00:00:32,270 --> 00:00:35,550 And the second 24 bits, or six hexadecimal digits, 14 14 00:00:35,550 --> 00:00:37,360 are going to be used to uniquely identify 15 15 00:00:37,360 --> 00:00:40,170 this particular network interface card on the network. 16 16 00:00:40,170 --> 00:00:42,170 The MAC address is assigned on the device 17 17 00:00:42,170 --> 00:00:43,710 when it's manufactured initially, 18 18 00:00:43,710 --> 00:00:47,000 and this is a hardware or burnt in physical address. 19 19 00:00:47,000 --> 00:00:47,910 For this reason, 20 20 00:00:47,910 --> 00:00:50,820 you should not have duplicate MAC addresses on your network, 21 21 00:00:50,820 --> 00:00:52,150 unless there's an incorrect assignment 22 22 00:00:52,150 --> 00:00:54,220 made during the production by the manufacturer, 23 23 00:00:54,220 --> 00:00:56,000 or if somebody in your network 24 24 00:00:56,000 --> 00:00:57,950 begins to use a self assigned address 25 25 00:00:57,950 --> 00:01:00,210 known as a locally administered address. 26 26 00:01:00,210 --> 00:01:02,600 Now, when a self assigned address is being used, 27 27 00:01:02,600 --> 00:01:04,990 this can often be an indication that MAC spoofing 28 28 00:01:04,990 --> 00:01:07,440 is being used by a client on your network. 29 29 00:01:07,440 --> 00:01:09,990 So what's wrong with having duplicate MAC addresses 30 30 00:01:09,990 --> 00:01:11,160 on the network? 31 31 00:01:11,160 --> 00:01:12,630 Well, when I think of this problem, 32 32 00:01:12,630 --> 00:01:14,980 I think back to elementary school in the late eighties 33 33 00:01:14,980 --> 00:01:16,290 and early nineties. 34 34 00:01:16,290 --> 00:01:17,430 You see when I was born, 35 35 00:01:17,430 --> 00:01:19,530 the name Jason was pretty darn common. 36 36 00:01:19,530 --> 00:01:21,910 This made it a little bit difficult for many of my teachers 37 37 00:01:21,910 --> 00:01:23,430 because they often had two or three kids 38 38 00:01:23,430 --> 00:01:24,860 in the class named Jason. 39 39 00:01:24,860 --> 00:01:26,700 So when the teacher would call out Jason, 40 40 00:01:26,700 --> 00:01:28,670 there was two or three kids who would respond. 41 41 00:01:28,670 --> 00:01:31,070 Or if the teacher got a note from Jason's mom, 42 42 00:01:31,070 --> 00:01:32,990 the teacher then had to figure out which Jason 43 43 00:01:32,990 --> 00:01:34,100 should get the response 44 44 00:01:34,100 --> 00:01:36,760 because she didn't know which mom it was. 45 45 00:01:36,760 --> 00:01:38,860 Now, the same thing happens in our networks. 46 46 00:01:38,860 --> 00:01:40,270 If you have two or more devices 47 47 00:01:40,270 --> 00:01:41,430 that respond to data requests 48 48 00:01:41,430 --> 00:01:43,310 directly from a given MAC address, 49 49 00:01:43,310 --> 00:01:45,780 this causes a lot of network issues. 50 50 00:01:45,780 --> 00:01:47,670 Now for example, if you have two devices 51 51 00:01:47,670 --> 00:01:49,070 using the same Mac address, 52 52 00:01:49,070 --> 00:01:51,220 your switch might mistake them for each other. 53 53 00:01:51,220 --> 00:01:52,900 And they might think they're the same device, 54 54 00:01:52,900 --> 00:01:55,340 and so the switch will keep updating its CAM table 55 55 00:01:55,340 --> 00:01:57,300 for the location of a single device. 56 56 00:01:57,300 --> 00:01:59,370 So it goes from port one to port three, 57 57 00:01:59,370 --> 00:02:00,830 to port one to port three 58 58 00:02:00,830 --> 00:02:03,250 and repeatedly starts going from one port to the other, 59 59 00:02:03,250 --> 00:02:05,810 when in reality, there's really two devices there. 60 60 00:02:05,810 --> 00:02:07,570 Now duplicate MAC addresses 61 61 00:02:07,570 --> 00:02:09,600 can also cause network conductivity issues 62 62 00:02:09,600 --> 00:02:11,850 because the switch doesn't know where to send the traffic 63 63 00:02:11,850 --> 00:02:13,680 destined for that particular MAC address. 64 64 00:02:13,680 --> 00:02:15,610 Because again, it's switching between two 65 65 00:02:15,610 --> 00:02:17,180 or three different ports. 66 66 00:02:17,180 --> 00:02:19,730 Now, luckily MAC addresses are only used 67 67 00:02:19,730 --> 00:02:21,070 in layer two networks. 68 68 00:02:21,070 --> 00:02:22,990 So once you reach a router in your network, 69 69 00:02:22,990 --> 00:02:25,150 the address is going to be converted to an IP address 70 70 00:02:25,150 --> 00:02:26,140 at layer three, 71 71 00:02:26,140 --> 00:02:27,930 so the extent of your connectivity issues 72 72 00:02:27,930 --> 00:02:29,890 is really going to be limited in scope. 73 73 00:02:29,890 --> 00:02:31,950 Now a more modern challenge that we have 74 74 00:02:31,950 --> 00:02:33,130 is with virtual machines 75 75 00:02:33,130 --> 00:02:35,280 and their virtual network interface cards, 76 76 00:02:35,280 --> 00:02:38,130 because these devices are only a series of ones and zeros, 77 77 00:02:38,130 --> 00:02:39,880 the virtual network interface cards 78 78 00:02:39,880 --> 00:02:41,630 have to be assigned a MAC address 79 79 00:02:41,630 --> 00:02:43,890 by a virtual machines hypervisor. 80 80 00:02:43,890 --> 00:02:46,310 To ensure you don't end up with duplicate MAC addresses 81 81 00:02:46,310 --> 00:02:47,960 caused by these virtual machines, 82 82 00:02:47,960 --> 00:02:51,200 you need to make sure you're using a Logical Domain Manager. 83 83 00:02:51,200 --> 00:02:52,960 Now, a Logical Domain Manager 84 84 00:02:52,960 --> 00:02:55,750 is used to listen to multicast messages on the network 85 85 00:02:55,750 --> 00:02:58,660 and keep track of all the MAC addresses that are being used. 86 86 00:02:58,660 --> 00:03:01,440 As it does this, it identifies if there's any duplicates 87 87 00:03:01,440 --> 00:03:02,680 and if it is, 88 88 00:03:02,680 --> 00:03:04,780 then it will go ahead and reassign MAC addresses 89 89 00:03:04,780 --> 00:03:07,760 for its virtual machines to prevent duplications. 90 90 00:03:07,760 --> 00:03:10,530 So how can you determine if there's a duplicate MAC address 91 91 00:03:10,530 --> 00:03:12,090 operating on your network? 92 92 00:03:12,090 --> 00:03:14,440 First, you're going to see network conductivity issues 93 93 00:03:14,440 --> 00:03:15,430 for two machines, 94 94 00:03:15,430 --> 00:03:17,950 and those machines will have duplicate MAC addresses. 95 95 00:03:17,950 --> 00:03:19,150 This is caused by the switch 96 96 00:03:19,150 --> 00:03:22,230 that continually has to go back and forth between two ports 97 97 00:03:22,230 --> 00:03:23,730 and updating its CAM table 98 98 00:03:23,730 --> 00:03:26,060 because it sees the same MAC address reporting itself 99 99 00:03:26,060 --> 00:03:27,510 on two different ports. 100 100 00:03:27,510 --> 00:03:29,020 This will cause intermittent connectivity 101 101 00:03:29,020 --> 00:03:30,130 for the two devices 102 102 00:03:30,130 --> 00:03:32,680 or one of the devices will have great connectivity 103 103 00:03:32,680 --> 00:03:35,490 and the other one will be completely non-responsive. 104 104 00:03:35,490 --> 00:03:38,640 Second, you could set up a protocol analyzer like Wireshark 105 105 00:03:38,640 --> 00:03:39,473 on your network. 106 106 00:03:39,473 --> 00:03:41,410 Then you can look at the network traffic, 107 107 00:03:41,410 --> 00:03:44,290 specifically the ARP traffic and see what IP addresses 108 108 00:03:44,290 --> 00:03:47,010 are being mapped and reported for each MAC address. 109 109 00:03:47,010 --> 00:03:48,720 If you see the same AMC address being used 110 110 00:03:48,720 --> 00:03:51,490 by two different machines or two different IP addresses, 111 111 00:03:51,490 --> 00:03:53,410 this could indicate a duplicate MAC address 112 112 00:03:53,410 --> 00:03:54,880 is on your network. 113 113 00:03:54,880 --> 00:03:56,180 To prevent issues on your network 114 114 00:03:56,180 --> 00:03:57,930 caused by duplicate MAC addresses, 115 115 00:03:57,930 --> 00:04:00,470 you can enable port security on your devices. 116 116 00:04:00,470 --> 00:04:02,680 This can be configured to allow a single MAC address 117 117 00:04:02,680 --> 00:04:05,140 to be configured to one single switch port, 118 118 00:04:05,140 --> 00:04:07,780 and then it's going to prevent any duplicate MAC addresses 119 119 00:04:07,780 --> 00:04:10,350 from accessing the network at the same time. 120 120 00:04:10,350 --> 00:04:12,160 Now, to identify switch boards that are used 121 121 00:04:12,160 --> 00:04:13,630 for particular MAC address, 122 122 00:04:13,630 --> 00:04:16,460 you can editor the show ARP command on your switch. 123 123 00:04:16,460 --> 00:04:18,490 Here's an example of running the show ARP command 124 124 00:04:18,490 --> 00:04:19,800 on a Cisco switch. 125 125 00:04:19,800 --> 00:04:22,650 Notice there are two matching MAC addresses in use here, 126 126 00:04:22,650 --> 00:04:24,370 both with different IP addresses 127 127 00:04:24,370 --> 00:04:26,550 and different physical interface ports. 128 128 00:04:26,550 --> 00:04:30,190 One is on fast ethernet 0/3/3/4 129 129 00:04:30,190 --> 00:04:32,623 and the other is on fast ethernet 0/3/3/5. 130 130 00:04:34,160 --> 00:04:36,420 This can cause conflicts or frames 131 131 00:04:36,420 --> 00:04:38,700 that simply aren't going to be delivered to the right devices 132 132 00:04:38,700 --> 00:04:40,060 on this switch. 133 133 00:04:40,060 --> 00:04:41,670 Now, once you identify the devices 134 134 00:04:41,670 --> 00:04:43,700 that are using the duplicate MAC addresses, 135 135 00:04:43,700 --> 00:04:45,470 you can check those devices locally 136 136 00:04:45,470 --> 00:04:47,620 to see if there's a hardware manufacturing issue 137 137 00:04:47,620 --> 00:04:50,060 that assigned the same MAC address to both devices, 138 138 00:04:50,060 --> 00:04:52,370 or, if this is the case in MAC spoofing, 139 139 00:04:52,370 --> 00:04:54,590 you want to make sure that you reset the MAC address 140 140 00:04:54,590 --> 00:04:56,330 back to the burned in physical address 141 141 00:04:56,330 --> 00:04:59,210 or remove that device from the network completely. 142 142 00:04:59,210 --> 00:05:01,120 If it's a hardware manufacturing issue, 143 143 00:05:01,120 --> 00:05:03,330 you're going to need to replace the network interface card 144 144 00:05:03,330 --> 00:05:05,260 to permanently solve this problem. 145 145 00:05:05,260 --> 00:05:08,120 Next, let's talk about duplicate IP addresses. 146 146 00:05:08,120 --> 00:05:10,170 A duplicate IP address is also known 147 147 00:05:10,170 --> 00:05:12,090 as an IP Address Conflict. 148 148 00:05:12,090 --> 00:05:14,590 This occurs when another computer on the same network 149 149 00:05:14,590 --> 00:05:17,410 has an identical IP to another workstation or server 150 150 00:05:17,410 --> 00:05:18,940 on that same network. 151 151 00:05:18,940 --> 00:05:21,890 Most often this occurs when you're using static IP address 152 152 00:05:21,890 --> 00:05:23,600 assignments for your network clients 153 153 00:05:23,600 --> 00:05:25,670 and you didn't properly account for which IPs 154 154 00:05:25,670 --> 00:05:29,000 were already used by other devices, or you had a typo. 155 155 00:05:29,000 --> 00:05:31,110 If you're using DHCP in this happens, 156 156 00:05:31,110 --> 00:05:33,080 this could be a DHCP server issue 157 157 00:05:33,080 --> 00:05:34,110 where it didn't properly account 158 158 00:05:34,110 --> 00:05:35,790 for the IPs it already issued out, 159 159 00:05:35,790 --> 00:05:38,180 or it could be the case of somebody statically assigning 160 160 00:05:38,180 --> 00:05:39,460 an IP to their client, 161 161 00:05:39,460 --> 00:05:42,380 even though the DHCP server has that IP address assigned 162 162 00:05:42,380 --> 00:05:43,870 as part of its scope. 163 163 00:05:43,870 --> 00:05:45,370 Now, a third reason this can occur 164 164 00:05:45,370 --> 00:05:48,070 is if you have a rogue DHCP server on your network, 165 165 00:05:48,070 --> 00:05:50,550 because that rogue DHCP server could be handing out 166 166 00:05:50,550 --> 00:05:53,710 the same IP addresses as your official DHCP server, 167 167 00:05:53,710 --> 00:05:54,590 and this can be happening 168 168 00:05:54,590 --> 00:05:57,240 from a private class C address IP scope. 169 169 00:05:57,240 --> 00:05:59,520 Now, if you have duplicate IP addresses 170 170 00:05:59,520 --> 00:06:01,740 being used by two devices on your network, 171 171 00:06:01,740 --> 00:06:03,620 this'll cause intermittent connectivity 172 172 00:06:03,620 --> 00:06:04,970 for both of those clients, 173 173 00:06:04,970 --> 00:06:06,270 because both of those clients 174 174 00:06:06,270 --> 00:06:07,900 are requesting network services, 175 175 00:06:07,900 --> 00:06:10,270 but the routers may not know where to send the traffic 176 176 00:06:10,270 --> 00:06:13,740 back to 'cause both clients are using the same IP address. 177 177 00:06:13,740 --> 00:06:15,960 To solve this, you should first check if the client 178 178 00:06:15,960 --> 00:06:19,040 is dynamically or statically assigned an IP address. 179 179 00:06:19,040 --> 00:06:22,140 As I said, most commonly, devices can be statically assigned 180 180 00:06:22,140 --> 00:06:24,800 an IP, and you're going to have a duplicate IP address issue 181 181 00:06:24,800 --> 00:06:26,710 because somebody typed in the wrong thing. 182 182 00:06:26,710 --> 00:06:29,160 To check this, go to your network adapter properties 183 183 00:06:29,160 --> 00:06:31,660 for TCP/IP version four in Windows 184 184 00:06:31,660 --> 00:06:32,690 and you're going to see, 185 185 00:06:32,690 --> 00:06:35,060 use the following IP address radio buttons there, 186 186 00:06:35,060 --> 00:06:36,250 and if that's selected, 187 187 00:06:36,250 --> 00:06:38,120 that means you're statically assigned. 188 188 00:06:38,120 --> 00:06:40,120 If your network is supposed to use DHCP, 189 189 00:06:40,120 --> 00:06:42,990 simply click, obtain an IP address automatically instead 190 190 00:06:42,990 --> 00:06:44,360 and then save your changes, 191 191 00:06:44,360 --> 00:06:46,160 and the network interface card will go out 192 192 00:06:46,160 --> 00:06:48,660 to the DHCP server and get the dynamic assignment 193 193 00:06:48,660 --> 00:06:51,450 for an IP address that it should use moving forward. 194 194 00:06:51,450 --> 00:06:53,510 If you want to identify the duplicate IP addresses 195 195 00:06:53,510 --> 00:06:54,670 on your network though, 196 196 00:06:54,670 --> 00:06:56,930 you can start by logging into the command line interface 197 197 00:06:56,930 --> 00:06:58,040 on your router. 198 198 00:06:58,040 --> 00:07:00,440 In my example, I'm going to use a Cisco router 199 199 00:07:00,440 --> 00:07:02,560 and I'm going to enter the command show ARP, 200 200 00:07:02,560 --> 00:07:05,550 just like we did when searching for duplicate MAC addresses. 201 201 00:07:05,550 --> 00:07:06,440 This time though, 202 202 00:07:06,440 --> 00:07:09,520 we're focused on IP addresses in that first column. 203 203 00:07:09,520 --> 00:07:13,890 Here, I see two IP addresses displayed with 10.1.4.2. 204 204 00:07:13,890 --> 00:07:15,700 The first one is located on interface, 205 205 00:07:15,700 --> 00:07:17,660 fast ethernet 0/3/3/4 206 206 00:07:19,171 --> 00:07:20,890 and the second one is on the interface 207 207 00:07:20,890 --> 00:07:22,883 fast ethernet 0/3/3/5. 208 208 00:07:24,730 --> 00:07:26,530 Now that we know which interfaces and switch ports 209 209 00:07:26,530 --> 00:07:27,540 are being used, 210 210 00:07:27,540 --> 00:07:30,370 we can check the configurations on those individual clients 211 211 00:07:30,370 --> 00:07:32,690 and we can ensure they're properly assigned statically 212 212 00:07:32,690 --> 00:07:35,440 or they're configured to receive a dynamic IP address 213 213 00:07:35,440 --> 00:07:37,273 from our network's DHCP server. 214 214 00:07:38,518 --> 00:07:40,740 (static vibrating)