Duplicate IP address Telnet and ARP

Question

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that PC3 first responds with it’s MAC address and then PC2 responds but that it is seen as a duplicate IP address and disregarded. Why is this? Why is PC3 not overwritten by PC2?

Answer 1

The answer previously marked correct is actually incorrect (to an extent). The resulting packet will be sent contained in a frame with a specific destination MAC address. The destination MAC address will be based on the senders ARP table.

An ARP reply is cached automatically regardless if it has expired. Therefore, the LAST response will be cached overwriting the first response received (this is exactly how and why ARP Poisoning works). You can research more on ARP Poisoning for more details on this.

The resulting connection to your "telnet" will be to the last device that has responded to the last ARP request that was broadcast to the broadcast domain.

A simplified explanation of what should be happening is below:

1. Sender does not have ARP table entry for IP:X.
2. Sender does an ARP Request broadcast for IP:X.
3. All devices in broadcast domain are sent ARP Request.
4. All devices configured with IP:X respond to ARP Request.
5. Sender receives each ARP Response 1 at a time. a. ARP Response #1 is received and MAC/IP pair is added to ARP table. b. ARP Response #2 is received and MAC/IP pair overwrites first response. ... (repeat "b" for each response)
6. Sender sends a packet with with the destination MAC address contained in the last received ARP Response.

However, if a responding device sees conflicting responses it has a few options based on RFC 5227. 1 of those being responding to configuration agent that its IP is invalid. Without seeing the packet capture its a hard to tell you exactly what you are seeing.

Answer 2

*please refer to Goblinlords answer it more accurately explains what I was trying to get accross.

If I'm not mistaken its because PC2 is slower to respond. When you make a telnet session you are creating a TCP session. This starts with a 3-way TCP handshake. Since you only sent one telnet connection request your client sees that it is already connected to ip 10.0.0.2 so it drops the reply from PC2 as a duplicate.

Basically your computer thinks that the response from the slower device is unsilicited. If you clear out the arp table and then try again lots of times you should see the same thing happen when PC2 responds first and the data from PC3 should get dropped.

Not sure what you are attempting to accomplish but I would suggest giving PC2 and PC3 unique ips.