Catch a duplicate IP and a pool exhaustion

applied · 55 min · Objective 5.3

Task

Diagnose two DHCP-adjacent faults by their symptoms: a duplicate IP address, whose tell is intermittent connectivity and an address that flips between two MACs, and address-pool exhaustion, whose tell is new clients landing on a 169.254 APIPA address while everyone already connected is fine. Both are hands-on and both are examined as symptoms.

Steps

  1. Create the duplicate. Statically set Host C to an address already leased to Host A — 192.168.10.10 — inside the DHCP scope with no exclusion, which is the usual real cause. Both now claim the same IP.
  2. Read the symptom. From the router or a third host, watch the ARP entry for 192.168.10.10 over several seconds: ip neigh show 192.168.10.10 shows the MAC flipping between Host A's and Host C's. That flip, plus intermittent reachability, is the duplicate-IP signature. The OS log usually carries a duplicate-address-detected message too.
  3. Fix it by returning Host C to DHCP or to an address outside the scope, and confirm the ARP entry settles to one MAC.
  4. Empty the pool. Shrink the scope to two addresses, then bring up two new clients to consume them. Bring up a third client and read its address: it falls back to a 169.254.x.x APIPA address and can reach only other APIPA hosts on the segment.
  5. Distinguish it from other faults. Note that existing clients with valid leases are unaffected — "new devices cannot connect while everyone already on is fine" is the exhaustion signature, not a general outage. Restore the scope.

Verify

ip neigh show 192.168.10.10
ip -4 addr show eth0 | grep -E "169\.254|inet "
journalctl -k 2>/dev/null | grep -i "duplicate" | tail -3

The ip neigh output showing one IP against two MAC addresses is the duplicate proven; after the fix it must show a single MAC. An interface address in 169.254.0.0/16 is the exhaustion proven — a client that asked DHCP for an address and got none. Those two readings are what turn "the network is flaky" into two named, different faults.

Notes

The duplicate-IP fault ties three domains together: it is created by a static device inside a DHCP scope with no exclusion, which is why the DHCP lesson treats scope, exclusion and reservation as one idea, and it is read with the same arp/ip neigh cache you used to detect ARP poisoning. The difference is the cause — misconfiguration here, attack there — but the cache symptom, one IP with two MACs, is nearly identical, which is worth holding both readings in mind.

Pool exhaustion has a preferred fix worth knowing for the exam: a shorter lease time usually beats a larger scope, especially on high-turnover segments like guest wireless where addresses are held long after the device has left. Enlarging the scope treats the symptom; shortening the lease returns addresses faster and treats the cause. Also consider a rogue device quietly consuming addresses, which turns exhaustion into a security question.