Q. I run quite large network with different subnets. I'd like to know how can I find out duplicate IP address under Linux / UNIX?
A. You can use arpping command. The arping utility performs an action similar to ping command, but at the Ethernet layer. You can send ARP REQUEST to a neighbor host / computers.
Task: Send ARP request
Let us find out reachability of an IP on the local Ethernet with arping i.e send ARP request 192.168.1.1:
$ sudo arping -I eth0 -c 3 192.168.1.1
Output:
ARPING 192.168.1.1 from 192.168.1.106 ra0 Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B] 2.232ms Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B] 1.952ms Sent 3 probes (1 broadcast(s)) Received 3 response(s)
Where,
- -I eth0 : Specify network interface i.e. name of network device where to send ARP REQUEST packets. This option is required.
- -c 3 : Stop after sending 3 ARP REQUEST packets
Task: Find duplicate IP
The -D option specifies duplicate address detection mode (DAD). It returns exit status 0, if DAD succeeded i.e. no replies are received.
$ sudo arping -D -I eth0 -c 2 192.168.1.1
If 192.168.1.1 duplicated you should see zero exit status:
$ echo $?
Always use following syntax for duplicate address detection with arping:
$ sudo arping -D -I <interface-name> -c 2 <IP-ADDRESS-TO-TEST>
$ echo $?
References:
- Ethernet Layer Tools - arping
- arping man page
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- My 10 UNIX Command Line Mistakes
- Linux: 20 Iptables Examples For New SysAdmins

- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- 10 Greatest Open Source Software Of 2009
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
Facebook it - Tweet it - Print it -


{ 4 comments… read them below or add one }
Be aware that there is an arping as part of the iproute2 package, and this arping is present on Red Hat systems when newly installed – and perhaps others.
This version is available from Thomas Habets.
David,
thanks for pointing out more information about arping. I believe they follows same syntax.
still the problem persists, even after using lan guard software i am able to find out the mac address of the duplicate ip, it makes my network to respond to mail server requests to slow down partially
can we check duplicate ip online