How to tell if someone is trying to use my IP Address?

Question

I use a relatively low-cost host for my personal server, and occasionally I get a rash of downtime alerts. These are all from today.

If my host were to ("accidentally") assign my IP to someone else, and that server came online and started fighting with mine for control of the IP, would it look like this? If not, I guess I have to assume the host is having hardware or network issues, or is possibly dealing with some sort of DoS attack, right? Of course, their client portal and company website are also suffering downtime, too; making it all but impossible to contact them and ask what's happening.

In the past I have occasionally seen this type of activity correlate with attempting to access my website and seeing the default website from a different server (which makes sense, since they wouldn't have host settings for my domain).

Short of manually checking all of my domains to see if something unexpected comes back, is there anything I can do to detect someone else attempting to use my IP address?

Answer 1

If you want to know if another host on the same segment is sending ARP replies when requests for your IP is being sent, the simplest approach is to simply send some requests yourself and verify whether you get a response. Here is an example command (and use your own IP address here):

arping -I eth0 198.51.100.241

If you suspect that it only happens intermittently, then running a tcpdump command in a screen session can collect evidence of this happening:

tcpdump -pni eth0 'arp' -s0 -Uw /var/tmp/arp.pcap

If neither approach give you sufficient information, you can start looking for other clues.

The IP address conflict will only affect packets being sent in one direction. So if you set up software on the server and elsewhere to periodically send a packet to each other and keep track of the sending as well as receiving time of each packet, then you will be able to see if packets are lost in one direction and not the other.

Additionally the IP address conflict is more likely to only affect one address family. So when your IPv4 address is unreachable you can log in using IPv6 and investigate as the problem is ongoing.

Finally simultaneous traceroutes from each end both during an outage and during normal operation will provide lots of information about the exact location of the outage.

Answer 2

If my host were to ("accidentally") assign my IP to someone else, and that server came online and started fighting with mine for control of the IP, would it look like this?

Network devices don't "fight" for their ip address. If your server were assigned a static ip address and another server in the same physical network were assigned the same ip address then there'd be an ip address confict on the network and traffic for that ip address would go to one or the other server, depending on which server answered the ARP query for that ip address, but the servers wouldn't "fight" for the ip address. There's no way for either server to tell the other server to stop using that ip address.

If the servers were assigned their ip address dynamically (with DHCP) then the provider would be using static reservations in DHCP to make sure that the same ip address is assigned to the same server (based on MAC address) and this scenario wouldn't likely ever occur. If it did occur for some reason then one of the servers would be assigned the ip address and the other server would be assigned a different ip address. The server wanting to use the ip address that has been assigned to the other server would be denied it's request to use the ip address and would be assigned a different ip address or would be assigned no ip address and would assign itself an ip address in the APIPA range, assuming the OS on the server supports APIPA.

My "educated" guess is that the provider had a hardware/network outage, based on what you've said about their own website being down and your being unable to contact them. Don't over think this. The provider had an outage.

My suggestion would be to find a more reliable provider.