This article was previously published under Q120599
The TCP/IP protocol may fail to start if another system using the same IPaddress is detected on the network. All the TCP/IP protocols currentlyshipping (as of 9/20/94) can detect duplicate IP addresses in most cases.The following information details how this happens and how to recognizeduplicate addresses in a network trace.
Each computer running TCP/IP uses a cache that contains mappings betweenIP addresses and media access control (MAC) or network adapter addresseson the network. The cache is maintained by the address resolution protocol(ARP) and is dynamic. When a connection attempt is made from one computerto another, the calling computer looks in its ARP cache for the targetcomputer's IP/MAC address entry, and then builds an outgoing framedirected to the MAC address of the target computer.
If the target computer's IP address is not in the cache, the callingsystem broadcasts an ARP frame onto the network. The ARP frame containsthe IP address of the target computer, and requests its MAC address. Ifthe target computer exists on the local sub-net then an ARP reply will bereturned to the calling computer, which updates its cache accordingly. Thecache must contain correct mappings for communications to function.
At system startup, when the IP protocol initializes, it sends an ARPrequest containing its own MAC and IP address so that other computers canupdate their ARP caches. If there is already a computer using the IPaddress, the "older" computer will respond with an ARP reply containingits MAC and IP address, indicating a conflict. Unfortunately, many othercomputers may have already updated their ARP caches with the new mapping.At that point, the "younger" computer that is initializing needs to do twothings:
Repair the ARP cache on all affected computers.
Cease using the duplicate address.
Computers running Microsoft TCP/IP will send out a new ARP broadcast to re-map the ARP cache on all affected computers. This new ARP will contain theMAC address and IP address of the older owner of the IP address. Aftersending this ARP, the IP protocol on the younger machine will report theproblem to the user and the stack will shut down. The stack should not bere-started until a unique address is obtained. Note that the computer maystill function at this point if another protocol such as NetBEUI isloaded.
Below is a network trace illustrating this behavior. It was captured on aToken Ring network.
Network Trace Illustrating Handling of Duplicate IP Addresses
At IP protocol startup, an ARP package is sent by the younger computer:
Here the IP address gets mapped back to the older computer's MAC address.
Windows NT version 4.0 Service Pack 3
Microsoft changed the way a Windows NT TCPIP computer reacts to a duplicateIP address with Service Pack 3. This change has not been made in any of theother TCPIP stacks. The new method of resolving duplicate IP addresses isas follows:
The "new" machine broadcasts an ARP request with its own MAC address andIP address.
The "older" computer will send an ARP reply directly back to the "newer"computer, indicating a conflict.
The "newer" computer will not initialize its TCP/IP stack.
The "older" computer will send an ARP broadcast with its own MAC addressand IP address to ensure other computers have a correct ARP cache entry forthe IP address that was in conflict.