Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Problem: There is a phantom device on our network. We have a exlusion in the DHCP scope for 5 ip addresses.

One of our users reports that they see something on Which they were about to use for a piece of their equipment they were installing. Sure enough, I ping the ip address and get a reply back from from the device.

So, I do an ARP -A and see what MAC address it reports back with. It reports back with an almost identical mac address as on of my servers, but that last digit in the 48 bit mac address is different.

So, I do another ping form another computer and sure enough it replied back, but this time when I do an arp -a and it reports back with a MAC address of our second server but off by last digit in the mac address.

Could this be a switch going bad? There is no NIC assigned this ip address or these mac addresses.

share|improve this question
Server got two NICs, someone's unplugged the cable and plugged it back into the wrong one? – nickgrim Feb 8 '13 at 16:36
up vote 1 down vote accepted

This could also be caused by Dell Open Manage Remote Access taking 0.159 by default on multiple servers. Doing an arp -a from multiple computers would result in different MAC addresses (always similar to the server on which Remote Access is on; usually one digit off) depending on what server you're being routed to.

This address wouldn't show up in DHCP under leases either.

share|improve this answer
wow, i think you are on to something..., but why would they pick .0.120 for both servers? – SomethingRED Feb 22 '13 at 6:34
How do I disable Dell Open Manage Remote Access? – SomethingRED Feb 22 '13 at 19:10

It sounds like a switch failing to me. You can use the app fing to scan your network or a single device and it will show you some additional information about the manufacturer of the NICs you're scanning.

In the screenshot below you can see that an Ubuntu box was detected and the MAC address had the manufacturer Cadmus computer Systems.


Example commands

# run against a single host
% fing

# run against an entire subnet
% fing
share|improve this answer
Fing produced the same results. I believe the this has to be some type of corrupted mac table on the switch. We have rebooted, but the the problem remains. Switch is pretty old. This happened one time before with the wireless access points and a firewall we had. The exact same problem, different equipment. The ip addresses we had assigned to the APs kept showing the MAC address of our firewall. The firewall had only 1 static ip assigned and the DHCP wasn't leasing out ips in that range. So, now to think about it has to be a corrupt table/bad switch. – SomethingRED Feb 8 '13 at 17:32
New managed switch did not fix the problem, but we could see the mac table in the cisco switch leading us to which mac address and port switch... – SomethingRED Feb 22 '13 at 6:47
So it was another switch that was failing and/or bad? – slm Feb 22 '13 at 16:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.