1

I use a relatively low-cost host for my personal server, and occasionally I get a rash of downtime alerts. These are all from today.

Downtime alerts

If my host were to ("accidentally") assign my IP to someone else, and that server came online and started fighting with mine for control of the IP, would it look like this? If not, I guess I have to assume the host is having hardware or network issues, or is possibly dealing with some sort of DoS attack, right? Of course, their client portal and company website are also suffering downtime, too; making it all but impossible to contact them and ask what's happening.

In the past I have occasionally seen this type of activity correlate with attempting to access my website and seeing the default website from a different server (which makes sense, since they wouldn't have host settings for my domain).

Short of manually checking all of my domains to see if something unexpected comes back, is there anything I can do to detect someone else attempting to use my IP address?

3
  • Maybe only your server is fighting with the DHCP server of your hoster. You should contact your hoster which may know more about that.
    – user219962
    May 31, 2015 at 16:02
  • 3
    If the hosters site suffers downtime too, how on earth do you come to your "fighting for IP" address conclusion?
    – Sven
    May 31, 2015 at 16:03
  • @sven "In the past I have occasionally seen this type of activity correlate with attempting to access my website and seeing the default website from a different server" -- clearly using the same IP address. May 31, 2015 at 16:14

2 Answers 2

4

If you want to know if another host on the same segment is sending ARP replies when requests for your IP is being sent, the simplest approach is to simply send some requests yourself and verify whether you get a response. Here is an example command (and use your own IP address here):

arping -I eth0 198.51.100.241

If you suspect that it only happens intermittently, then running a tcpdump command in a screen session can collect evidence of this happening:

tcpdump -pni eth0 'arp' -s0 -Uw /var/tmp/arp.pcap

If neither approach give you sufficient information, you can start looking for other clues.

The IP address conflict will only affect packets being sent in one direction. So if you set up software on the server and elsewhere to periodically send a packet to each other and keep track of the sending as well as receiving time of each packet, then you will be able to see if packets are lost in one direction and not the other.

Additionally the IP address conflict is more likely to only affect one address family. So when your IPv4 address is unreachable you can log in using IPv6 and investigate as the problem is ongoing.

Finally simultaneous traceroutes from each end both during an outage and during normal operation will provide lots of information about the exact location of the outage.

1
  • 3
    The program arpwatch can be configured to email you on a number of events, one of which is IP address conflicts.
    – BillThor
    May 31, 2015 at 21:26
4

If my host were to ("accidentally") assign my IP to someone else, and that server came online and started fighting with mine for control of the IP, would it look like this?

Network devices don't "fight" for their ip address. If your server were assigned a static ip address and another server in the same physical network were assigned the same ip address then there'd be an ip address confict on the network and traffic for that ip address would go to one or the other server, depending on which server answered the ARP query for that ip address, but the servers wouldn't "fight" for the ip address. There's no way for either server to tell the other server to stop using that ip address.

If the servers were assigned their ip address dynamically (with DHCP) then the provider would be using static reservations in DHCP to make sure that the same ip address is assigned to the same server (based on MAC address) and this scenario wouldn't likely ever occur. If it did occur for some reason then one of the servers would be assigned the ip address and the other server would be assigned a different ip address. The server wanting to use the ip address that has been assigned to the other server would be denied it's request to use the ip address and would be assigned a different ip address or would be assigned no ip address and would assign itself an ip address in the APIPA range, assuming the OS on the server supports APIPA.

My "educated" guess is that the provider had a hardware/network outage, based on what you've said about their own website being down and your being unable to contact them. Don't over think this. The provider had an outage.

My suggestion would be to find a more reliable provider.

2
  • We're definitely not using DHCP. Is it within the realm of possibility that a "last-in wins" policy is in use somewhere, so that when a 2nd server comes online with the same IP address, the first would become inaccessible? In that case, the appearance of "fighting" might be the 2nd server going online and offline frequently for unrelated issues. Anyway, thanks for the details. May 31, 2015 at 16:42
  • "There's no way for either server to tell the other server to stop using that ip address." -- I figured as much, but is there any way to detect that it's happening so that I could call the host and complain? May 31, 2015 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.