Solaris

I have following message in my messages file on solaris 10

Code:

WARNING: e1000g3712000:3 has duplicate address 010.022.196.011 (in use by 00:50:56:85:25:ef); disabled

Now is there any way i can find which server has 00:50:56:85:25:ef mac address either IP or Hostname ?

Hi,

If you have root privileges, you can use "ifconfig -a", which will display the MAC address along with the IPs. Also, "banner" command at OK prompt will display the MAC addrs. If you do not have root privs - you can NOT see the MAC addr !!

In your case, disable the NIC in your system. From another system, do a "traceroute 10.22.196.11". That will lead you to the another system that is using the IP.

Hope I answered your question.

you already have the IP adress of the server the closes thing i can think of to localize the particular server is to check from your switch which port it is connected to by using the mac address. been into this kind of situation and have asked our network guys for help

Something that may help is to realize that the first three numbers in a MAC address indicate the manufacturer. In this case, whatever has that address belongs to VMware, so it's probably a VM somewhere.

yep u r correct Tony the system was a VMware VM, but how do u know that 00:50:56 belongs to VMware .. ?

There's a complete list of assigned vendor codes available at the IEEE, as well as various lookup tools on the web.

Yes, the easiest way is to run arp -a on the subnet where the conflict occurs and then look at the arp cache.

It is really difficult in most networks to map vendor IDs from MAC addresses to actual hosts, so the first step is to look at the arp cache and find out which IP address is mapped to which MAC address.