This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Duplicate IP addres from Sonicwall TZ-215

0

I have an Copper pipe which includes 60 usable Public IP Addresses.

Maybe 20 of them are actually in use; lets say 10.0.0.2 - 10.0.0.22 ( using local IPs for security )

I am currently getting intermittent connectivity on my network.

I assigned my laptop 10.0.0.2 and all other routers are assigned 10.0.0.x if x > 2 && x <=22

I am pinging the HP1810 switch, 10.0.0.3, and one router, 10.0.0.4. I am also pinging the Main Router IP, 10.0.0.1, the WAN serial IP, 192.0.0.1 and DNS, 4.2.2.2

From External I am pinging 10.0.0.3 and 192.0.0.1

When the issue occurs, I lose packets on my internal ping ONLY to 10.0.0.1, 192.0.0.1, 4.2.2.2. I do not lose packets on internal pinging to 10.0.0.3, 10.0.0.4, nor do the external pings show dropped packets.

It appears that something is clogging things up such as a broadcast, loop, or duplicate IP addresses.

I troubleshooted by running wireshark from my laptop on 10.0.0.2. I then ran an ipscanner to the subnet to get the ARPs back from them.

When I apply filter : expert.message contains "Duplicate IP address"

I see a lot of

Duplicate IP address detected for 10.0.0.z (xx:xx:xx:xx:xx:xx) - also in use by yy:yy:yy:yy:yy:yy (frame 149)

Now the MAC address xx:... correlates to a Sonicwall TZ-215 and z has been 10 different IPs and yy:... mac address has been 10 different MACs.

Is this what is causing my issues? the Sonicwall somehow fixing itself to multiple IP address on the subnet?

I also received the following:

582 7.423492000 Cisco_ xx:xx:xx Dell _yy:yy:yy ARP 60 Who has 10.0.0.2? Tell 10.0.0.15 (duplicate use of 10.0.0.15 detected!)

and

583 7.423559000 Dell_ yy:yy:yy Cisco _xx:xx:xx ARP 42 10.0.0.2 is at yy:yy:yy:yy:yy:yy (duplicate use of 10.0.0.15 detected!)

Now the Dell with yy:... MAC address is my laptop that sent out the ipscan and the Cisco xx:... is presumably a router with the ip address 10.0.0.15

What is that about as well?

Thanks for the help peoples!!

asked 14 Aug '12, 11:57

eherr9633's gravatar image

eherr9633
1111
accept rate: 0%


One Answer:

0

Is this what is causing my issues? the Sonicwall somehow fixing itself to multiple IP address on the subnet?

Sounds like the SonicWall is doing Proxy ARP for parts of the network. This can be caused by

  • running the SonicWall in bridged mode
  • A "wrong" NAT policy on the SonicWall, which can cause it to perform Proxy ARP for the local network
  • a possible configuration error with VPN IP pools. If you chose a part of your LAN network for the VPN pool, the firewall could do ProxyARP for those IP addresses as well. I have seen this with other firewalls, but I can't remember if I have ever seen it with SonicWall!
  • a bug in the firmware

If the SonicWall is not configured for bridging, I suggest to look for any "strange" NAT rules, that don't make any sense in your environment. Think TWICE, then disable them. Then clear the ARP cache on your test system and try again.

Regards
Kurt

answered 14 Aug '12, 16:18

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%