[SOLVED] Find Duplicate IP Address with Wireshark

Every device on a network — laptop, desktop, printer, phone, or tablet — needs a unique IP address. When two stations share the same address, an IP conflict breaks connectivity for one or both hosts.

How duplicate IP conflicts happen

Most duplicate IP problems come from configuration mistakes, not from random DHCP bugs.

A common scenario is a network printer with a manually assigned static IP. That keeps the address stable for shared printing, but it only works if nothing else on the LAN already uses that address.

The risk appears when the DHCP server does not check whether an address is already in use before leasing it. The server may later hand the printer's static address to another station. Well-behaved clients and servers can run an ARP-based check first; see detect a rogue DHCP server with Wireshark for how that looks in a capture.

The screenshot below is Windows reporting an IP conflict. The dialog confirms the clash but does not name the other MAC or hostname using the duplicate address.

Windows detects the clash with ARP: before fully using an address, the host asks whether another client already claims it.

What is ARP, and how does the OS detect a duplicate IP?

ARP (Address Resolution Protocol) maps an IP address to a MAC address on the local segment. The lookup works for private RFC 1918 addresses and for routable public addresses on the same L2 domain.

After DHCP assigns an address — or after you set one statically — the station sends an ARP probe to learn whether another host already uses that IP. The sections below walk through normal ARP exchange first, then duplicate detection.

The process of mapping an IP address to a MAC address using ARP is below.

Step-1: As it is seen in the below screenshot, the station prepares an ARP request packet, which includes following information:

• Sender MAC: This field contains the station’s (senders) MAC address.
• Sender IP Address: This field contains the station’s (senders) IP address.
• Target MAC Address: The goal of the request is to obtain target MAC address. The sender leaves this field empty and expects the target to fill it.
• Target IP Address: The station (sender) inserts the target IP address here.

The station broadcasts this packet and expects the target to reply back.

Step-2: The target replies the station with filling the information below:

• Sender MAC: This time the target becomes the sender and adds its MAC address here.
• Sender IP Address: The target inserts its own IP address here.
• Target MAC Address: The station’s MAC address is inserted here.
• Target IP Address: The station’s IP address is inserted here.

With the reply packet, the station maps the IP address (192.168.1.1) to the MAC address (ca:01:42:f8:00:00). We can check the mapping in the ARP cache (table) with “arp -a” command on both Windows and Linux operating system.

The station on the network can use the same logic to discover duplicate IP addresses. Following steps shows how the station discovers duplicate IP address.

Step-1: After receiving the IP address (192.168.20.1) from the DHCP server, the station needs to make sure if this IP address is already in use. The station uses an ARP Probe, which is an ARP request constructed with an all-zero sender IP address.

Step-2: A host that already owns the offered IP replies. That reply proves the address is in use.

The client then treats the lease as invalid and sends DHCP DECLINE to refuse the conflicting address.

Find duplicate IP addresses with Wireshark

Use Wireshark when you need to prove which hosts advertise the same IP, not only that Windows or Linux reported a conflict.

The workflow has two parts:

1. Capture packets long enough to collect ARP traffic on the segment.
2. Apply display filters that flag duplicate addresses and list every MAC claiming the same IP.

Passive capture alone can take time. You can speed it up by pinging (or otherwise probing) every host in the subnet so each address triggers ARP. Before ICMP leaves the station, the OS resolves MAC addresses with ARP — those requests and replies are what you filter in Wireshark.

The sections below use a sweep script on Windows and Linux, then apply arp.duplicate-address-detected and related filters to the capture.

In Windows:

We will use the syntax below for the script:

FOR /L %%parameter IN (start, step, end) DO command

• start : The first number
• step : The amount by which to increment the sequence
• end : The last number
• command : The command to carry out, including any parameters.
• %%parameter : A replaceable parameter.

The script basically starts pinging from 192.168.1.1 to 192.168.1.255.

for /l %i in (1,1,255) do ping -n 1 192.168.1.%i

Before running the script, we need to delete the ARP cache with the command below. If we do not delete the cache, the station will not make requests for the entry in the ARP cache.

After running the script, we will have all the ARP requests and replies with Wireshark like below.

So How do we find which IP addresses are duplicated? It is pretty easy, just follow the steps below.

Step-1: We will apply “arp.duplicate-address-detected” as display filter to find which IP addresses are duplicated. The packet below shows which IP address (192.168.1.5) is duplicated and its frame number as well.

Step-2: To see all hosts using 192.168.1.5, we apply "arp.src.proto_ipv4 == 192.168.1.5" display filter. The result is below.

In Linux:

The same result can be achieved with the script below.

Send a bounded ICMP echo test with ping -c; the ping command covers count, interval, and interpreting packet loss.

#! /bin/bash

for ip in $(seq 1 255); do
   ping -c 1 192.168.1.$ip
done

Final Thoughts

During an IP conflict, traffic may reach the wrong MAC address or fail entirely. When you suspect a duplicate lease or static clash, Wireshark display filters such as arp.duplicate-address-detected show which IP is contested and which frames to inspect next.

References

• RFC 5227 — IPv4 Address Conflict Detection
• Wireshark display filter reference — ARP