an unknown ip on network

Question

In our office we have many PCs, all of them have static IP addresses.
We had a problem with one server with ip 192.168.1.10 dropping off the network occasionally. I unplugged the network cable from the server and from pinged 192.168.1.10 from another host and there was a response.

I searched all PCs to see if any has such ip but i didn't found a one. I changed the server ip to fix the problem, but I still find this rogue device using 192.168.1.10 on the network -- how can I figure out what it is?
Could it be the ip of virtual machine on someone's PC?

Answer 1

A virtual machine's IP would be a possibility.

If you try to find this device you could start determining its MAC address (on Linux by running 'arp' and looking for the bad IP).

Next, if you have managed (layer 2) switches in your network you can ask them to tell you which port has this MAC address associated. Then you can either walk to the port and follow the cable or disable the port and wait until someone angry walks up to you. ;)

Answer 2

Install NMap (Linux or Windows) and run:

nmap -vv -o 192.168.0.10

(-vv = Very Verbose, -o = Detect Operating System)

This should give you a good idea of what kind of device it is, it's MAC Address, open ports, etc.

Answer 3

Your problem was an IP conflict between the server and the other machine To identify the pc that has the IP open command prompt and type nbtstat -A This will provide you with the netbios name of this machine.

Answer 4

If you look in the event log on the Server, you should see a logged event for the IP conflict...in that log entry it will tell you the MAC of the offending device.

Once you have the MAC then you can either apply MAC filtering to know it off your network or use DHCP reservations to give it some IP other than what your server uses. Not sure if you were wanting to return the .10 IP to your server or if you don't care that you had to change it.