Today I found out that I don't know how to fix IP conflicts.

Say you have a server with IP1

another machine connects and assigns itself IP1.

How do people usually prevent this? How they(you) resolve?

I heard that usually it is secured by ROUTER. Is that correct?

And it is the only way?


My question was about the situations when some user just assigns server IP to itself and that would cause problems.

But I found out that system administrators just should control all the hosts and machines and never allow users to assign any IP but given by Admin (read as given by DHCP server)

| improve this question | | | | |

If you had a DHCP server on your network, it would manage a range of IP adresses and assign new clients one of them, making sure no two clients use the same IP at the same time.

Some hardware routers already include a DHCP server (particularly those for home-use) and several Linux distributions include a DHCP server role. Of course clients would have to be configured to use the DHCP server instead of having fixed IP addresses or assinging themselves one (as Windows does when it can't get one via DHCP).

| improve this answer | | | | |
  • it is said "manually assigns IP to itself" so it's not about DHCP – bakytn Feb 28 '12 at 7:16
  • DHCP is indeed the way to do this. with static reservations if needed for the servers, usually outside the dhcp-pool. – Sirex Feb 28 '12 at 11:30
  • Accepted this because: read UPDATE section – bakytn Feb 28 '12 at 15:05
  • more importantly, the users should not (nearly always) have the permissions needed to set their own IP addresses in the first place. – Sirex Feb 28 '12 at 15:12

If you are manually assigning IP addresses for devices that are on the same network, it is up to you to ensure they do not conflict.

The usual route is as @PersonalNexus says - DHCP - which can auto-assign them in such a way that you do not get conflicts. This is the simplest for a large network, in fact for very large networks it is the only practical solution.

An alternative, which is very messy (and one I would not recommend), is to have each device on a separate network (and actually run networks to each patch point) - this, however, requires you to set up the router/switch to cope with multiple LANs or VLANs using the same network space so requiring every one to be NAT'ed. If you are haven't had experience managing network conflicts I would suggest configuring a switch to do this may be exceptionally difficult.

| improve this answer | | | | |

There is no real way to block users from assigning themselfs IPs by random ( = risk a colliding IP) but to restrict them from assigning the IPs themself - aka by the admin's own hand or by DHCP.

If the network is a little larger it might be a good idea to seperate into client and server vlans with some routing (L3-Switch) in between - so at least the precious servers are safe from these coliding IPs. - but no need for a vlan for each server - just one vlan where only the admin can change things and no user has physical access and just plug in their laptops...


| improve this answer | | | | |

One way to do it is to assign each server its own vlan. Any IP ranges that the server should have access to are assigned to that vlan. They are not permitted to use any IP that falls outside those ranges (the router simply won't route it to them).

The other option is to statically route all traffic for a certain IP to a certain MAC address. This isn't great, as there's a brief period where if the server gets rebooted another client can claim the MAC address.

| improve this answer | | | | |
  • 1
    MAC addresses are (typically) not randomly picked on boot. – Vatine Feb 28 '12 at 14:06
  • I never said they were. However, if you've got a malicious device on the network, it can easily change it's mac address to be the server's. Then, they just have to wait for ARP to time out (which usually happens on reboot), and they start getting all the traffic destined for the server. – devicenull Feb 28 '12 at 15:14
  • that's what port security is for. – Sirex Mar 1 '12 at 7:47

With certain switches you can restrict exactly what ip addresses are allowed on each port. For example, on a Cisco you could do:

ip access-list standard fa001
int Fa0/1
ip access-list fa001 in

What this means is that the only ip address allowed to be on the device on Fa0/1 is If the user tries adding other ip address, they'll get no where.

Of course this will only work where each host has a static ip. It might work as well with DHCP!

This is on Cisco, but I'm sure other switches have similar features.

| improve this answer | | | | |

You have some DHCP server running on your network that gave it this address. Could be a DHCP router/ switch (probably) or just some box with dhcpd running on it. Which makes it kind of a network-server. It is very normal that you get conflicts and other problems when you use both techniques on 1 network.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.