IP Address conflict in a LAN

Question

How to find if someone has taken a particular IP address in a Local Area Network? Or in a more generalized form, how to find the list of IP address that DHCP has allocated in a Local Area Network?

Answer 1

If you want to know what your DHCP server has leased out, you need to consult that DHCP server. On Linux (Debian with isc-dhcp-server), you want to look at the /var/lib/dhcpd/dhcp.leases file.

If you want to know if another machine is using that IP without doing that, you can try several methods:L

• Use the arp command to see if the IP appears in your system's arp table. If it does, your system has likely communicated with that IP recently and something has responded.

• ping the IP and see if you get a response.

• Use telnet or nc to make a TCP connection to a known working service. This requires you to know what services might be running and of course if it doesn't work, it could just mean the services aren't running or have locally blocked you.

• Install arping and use it to issue ARP requests directly.

Use nmap in @vembutech's answer if you want to scan the network for anything that responds. Be careful, it could generate traffic that looks hostile if you are on a corporate LAN.

Answer 2

You need to install nmap in the Terminal with root permission:

sudo apt-get install nmap

Following command find all the particular network IP addresses:

nmap -sP 172.16.1.*

Answer 3

It depends on your dhcp server.

On most networks, it lies on the router. typically they have a web interface that you can access that will show you all the active leases and the mac addresses associated with them.

Someone mentioned that you can use nmap to see what ip addresses on the network, This is true to a point. Nmap will not show duplicate addresses, and it will not show lease information (eg, it will also show ip addresses that have been statically assigned.). This may or may not suit your purposes.