TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hello,
What is the most probable, (and what is mostly seen on the access Network I
work on) is that two computers try to share the same IP address on your
accessible network. MAC 1 and MAC 2 are the Ethernet MAC addresses of the
two clients sharing the involved IP. That may be because:
1/ You have fixed on your terminal an public IP which wasn't explicitly
given by your ISP, what make you conflicting with its "true" owner any where
he maybe.
Or, in this fact it the same problem but a bit hidden, if you've fixed a
private IP but access through routers which route private IP to some other
network where it has been fixed too (i.e. 192.168.0.2 on networks A and B).
In fact routing private IP is current even if they shouldn't been routed
after the private gateway. That may come on cable Internet access between
users connected to the same Network-Head because on most of their access MAN
private IPs are internally routed , on distant and delocalized private
network through wrongly mounted gateway ...(60% of our duplicate address
issues are in that way resolved)
1/ You're using a somewhere a DHCP's service on your network and some
terminal have seen fixed one of its pool IP fixed in its own TCP/IP
properties. This may come from not having configured a ping test before the
DHCP hack or for race requests on a DHCP which doesn't implement control on
its 'in offering delay' pool during the offer. (30% of our duplicated
address issues). Sometimes you could see it (without any netfreezing) on the
connection of an Windows terminal. On dynamical Network, most of these OS
steal the discover phase and directly ask for the IP they had during their
last connection... what makes sometimes appear an Ethernet conflict which is
immediately resolved when the DHCP refuse the attribution and provide a new
IP. In that last case, the conflict event is more an 'indication' than a
real issue alert.
2/ You're using Ethernet cards drivers which permit to masquerade your
cards MAC (realtech, 3com drivers are known to permit such manipulation) and
have put two of your computer with the same MAC. That could happen if you
made a ghost of one computer which was configured with the drivers
enhancement. Notice that the duplicate MAC would impact the true Ethernet
MAC of your card and not the "masqueraded one".
Hopping it helps
S.Y.
Chris.
(Sorry for my English)
Original Message -----
From: "Means, David (ISS Atlanta)" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, June 24, 2002 3:13 PM
Subject: RE: Duplicate IP event - how does it use ARP and what do the fields
mean (exactly)?
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
> --------------------------------------------------------------------------
--
>
> MAC1 and MAC2 are the Media Access Control address of the NIC associated
> with the IP addresses in question (
> http://foldoc.doc.ic.ac.uk/foldoc/foldoc.cgi?Media+Access+Control )
>
> If at all possible, I'd like to have a capture of your traffic and copy
your
> policy file.
>
> David
>
>
> -----Original Message-----
> From: Jason Renard [mailto:[EMAIL PROTECTED]]
> Sent: Saturday, June 22, 2002 1:02 PM
> To: [EMAIL PROTECTED]
> Subject: Duplicate IP event - how does it use ARP and what do the fields
> mean (exactly)?
>
>
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> --------------------------------------------------------------------------
--
>
> Hi,
>
> I'm still having problems with duplicate IP address alerts and would value
> any ideas.
>
> I'm running a small static test system and I'm not doing anything fancy
with
> routers etc.
>
> I've even left an arp trace running and inspected the packets at and
around
> the time of the
> RealSecure alerts, but all the arp packets (requests and responses) all
look
> fine - normal broadcast
> requests and unicast responses from the correct MAC addresses.
>
> If I can't figure out how to analyze duplicate IP address alerts in a
simple
> environment like this,
> especially when I've got a corresponding arp trace, then I'm going to have
> problems in the wild.
>
> Please could somebody explain how RealSecure determines duplicate IP
address
> events, or at least the
> meaning of the MAC1/MAC2 fields in the Event Details window?
>
> Thanks,
> Jason
>
> On Fri, 14 Jun 2002 16:50:49 +0100, Jason Renard <[EMAIL PROTECTED]>
> wrote:
>
> >
> >TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
> >[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
>
>---------------------------------------------------------------------------
> -
> >
> >Hi,
> >
> >I have the following in a small test environment (all v65):
> >
> >System [S2] with IP address [I2] MAC address [E2] - it's a Network Sensor
> >System [S3] with IP address [I3] MAC address [E3] - it's an Event
Collector
> >System [S5] with IP address [I5] MAC address [E5] - it's a console
> >
> >Occasionally I see a Duplicate IP address event (there was one last night
> at 00:35), for example:
> >
> >Duplicate IP address (Suspicious arp)
> >
> >SourceIPaddress: I2
> >DestIPaddress: I3
> >SourceEthernetAddress: E2
> >SourceEthernetAddress: E3
> >MAC1: E5
> >MAC2: E2
> >
> >The online help says "RealSecure Network Sensor detects the duplicate IP
> address by monitoring ARP
> >packets and comparing the MAC address and IP addresses found in each
> packet. When it detects two
> >packets with the same IP address address, but different MAC addresses it
> creates this IPDuplicate
> >event"
> >
> >Please could somebody help with the following?
> >
> >1) Does RealSecure only use ARP packets or will it examine normal IP
> packets as well? The latter
> >would be more of an overhead, however it could catch more instances of
> duplicate IP addresses.
> >
> >2) If RealSecure only uses ARP packets, does it use the DLC
> source/destination from those packets or
> >does it use the payload Sender/Target fields?
> >
> >3) Does RealSecure apply this processing to both SOURCE and DESTINATION
> addresses?
> >
> >4) Most importantly, WHAT DO THOSE FIELDS MEAN? I presume the first four
> fields relate to the packet
> >which tripped the event, and I'm assuming it was probably an ARP reply.
So
> what do the fields MAC1
> >and MAC2 mean?
> >
> >5) ANY other info on this topic would be appreciated so that I can try to
> put these events into
> >context.
> >
> >Thanks,
> >Jason
> >
> >Jason Renard
> >
> >Warning - all views expressed are my own.
> >I cannot guarantee the accuracy of everything
> >I've said - use it at your own risk.
> >
> >
>
>
> Jason Renard
>
> Warning - all views expressed are my own.
> I cannot guarantee the accuracy of everything
> I've said - use it at your own risk.
>
>
>
