Solved MAC address of docking station - wrong diagnosis of problem

B

balanga

Do docking stations have their own MAC addresses?

I am getting duplicate IP addresses and suspect that it is because I'm using a laptop in a docking station which is different to the one which was previously used, and that one has not yet rebooted....
 
balanga said:
Do docking stations have their own MAC addresses?
Click to expand...
Some do, some just copy the MAC address of the laptop's ethernet interface.

balanga said:
I am getting duplicate IP addresses
Click to expand...
You won't get duplicate IP address because of that. If the MAC address was different the DHCP server would assign a different IP address to it. If it was the same MAC address it would receive the IP address on the docking station but the laptop's internal interface would have been disabled. A docking station without a laptop won't be active.

I suspect there's something with a static IP address in the same range as your DHCP. Normally the DHCP server would ping an address before assigning it, this is specifically done to prevent the server from passing an IP address that's already configured statically. But the static IP address machine may have been off when you got your DHCP IP address. When that static machine is turned back on you'll get a duplicate IP.
 
In the ports is a tool named net/arping. Basically arping(8) works like ping(8), howewer, besides IP's it can also ping MAC addresses, and as a result it informs both.

For example: arping 192.168.0.1
-> 42 bytes from 00:11:0a:56:29:64 (192.168.0.1): index=0 time=882.283 msec

Then I use https://dnschecker.org/mac-lookup.php in order to find out the vendors's name of the respective NIC. This might give enough information for an educated guess on which device is occupying a given IP address.

Bildschirmfoto 2019-11-01 um 08.17.37.png
 
If you have managed switches you can trace back the MAC address to a specific switch port and be certain who the culprit is.
 
I stopped using docking stations with my T61's after pulling the cord of a USB mouse I had plugged into the station while it was compiling ports and watched it go to laptop heaven. The docking station was brand new and the laptop looked like it just came out of the box.

I didn't cry but felt like it. :p
 
After changing the dhcp entry (on pfSense) for the laptop I'm having problems from x.x.x.220 to x.x.x.222 I'm still having problems.

Code: 
root@S09:~ # arping 192.168.1.222
ARPING 192.168.1.222
60 bytes from 00:23:24:43:2b:70 (192.168.1.222): index=0 time=393.875 usec
42 bytes from f0:de:f1:77:c6:a8 (192.168.1.222): index=1 time=934.787 msec
60 bytes from 00:23:24:43:2b:70 (192.168.1.222): index=2 time=353.883 usec
60 bytes from 00:23:24:43:2b:70 (192.168.1.222): index=3 time=382.961 usec

Code: 
root@S09:~ # ifconfig em0
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=81249b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LRO,WOL_MAGIC,VLAN_HWFILTER>
    ether f0:de:f1:77:c6:a8
    inet 192.168.1.222 netmask 0xffffff00 broadcast 192.168.1.255 
    media: Ethernet autoselect (1000baseT <full-duplex>)
    status: active
    nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Code: 
Nov  1 11:41:46 S09 login[1164]: ROOT LOGIN (root) ON ttyv0
Nov  1 12:02:27 S09 kernel: in6_purgeaddr: err=65, destination address delete failed
Nov  1 12:02:27 S09 kernel: lo0: link state changed to DOWN
Nov  1 12:02:27 S09 dhclient[652]: My address (192.168.1.222) was deleted, dhclient exiting
Nov  1 12:02:27 S09 dhclient[652]: short write: wanted 20 got 0 bytes
Nov  1 12:02:27 S09 dhclient[652]: exiting.
Nov  1 12:02:28 S09 kernel: lo0: link state changed to UP
Nov  1 12:02:29 S09 kernel: em0: link state changed to DOWN
Nov  1 12:02:32 S09 kernel: em0: link state changed to UP
Nov  1 12:02:33 S09 dhclient[1826]: New IP Address (em0): 192.168.1.222
Nov  1 12:02:33 S09 kernel: arp: 00:23:24:43:2b:70 is using my IP address 192.168.1.222 on em0!
Nov  1 12:02:33 S09 dhclient[1827]: New Subnet Mask (em0): 255.255.255.0
Nov  1 12:02:33 S09 dhclient[1828]: New Broadcast Address (em0): 192.168.1.255
Nov  1 12:02:33 S09 dhclient[1829]: New Routers (em0): 192.168.1.1
Nov  1 12:02:34 S09 kernel: arp: 00:23:24:43:2b:70 is using my IP address 192.168.1.222 on em0!

I don't have a clue about what is happening....

I just try to arping the old IP address 192.168.1.220 and got the same MAC address as 192.168.1.222

Code: 
root@S09:~ # arping 192.168.1.220
ARPING 192.168.1.220
60 bytes from 00:23:24:43:2b:70 (192.168.1.220): index=0 time=260.424 usec
60 bytes from 00:23:24:43:2b:70 (192.168.1.220): index=1 time=359.515 usec
60 bytes from 00:23:24:43:2b:70 (192.168.1.220): index=2 time=237.768 usec

I also get the same for 192.168.1.221!!!!

Could this be a problem with pfSense? It only happens on this one laptop,
 
I've removed the laptop which had the problem from the network, but I can still arping 192.168.1.220-222 and all three addresses return 00:23:24:43:2b:70 as the MAC address. Looking at pfSense's Leases table shows this MAC address is used to assign the IP address of 1were 92.168.1.60 to a particular system.

Eventually when I figured out which system this was, I found that these IP addresses were assigned to three jails.... which I have forgotten about :oops::rolleyes:
 
You must log in or register to reply here.
Back
Top