Too many duplicate IP with same MAC address in output of arp-scan

networking

My company network is very unstable. It takes so much time to ping to gateway about 50ms or higher. I did some troubleshoot to find out the cause. I have to try arp-scan when network is unstable and see many duplicate IP with same MAC address. This is a section of output:

192.168.6.1 00:1d:xx:xx:xx:xx   xxx Corp.
192.168.6.1 **e8:9a:xx:xx:xx:xx**   Quanta Computer Inc. (DUP: 2)
192.168.6.4 0a:55:xx:xx:xx:xx   (Unknown)
192.168.6.5 0a:55:xx:xx:xx:xx   (Unknown)
192.168.6.10    64:66:xx:xx:xx:xx   (Unknown)
192.168.6.29    50:e5:xx:xx:xx:xx   GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.6.31    08:9e:xx:xx:xx:xx   (Unknown)
192.168.6.38    30:65:xx:xx:xx:xx   (Unknown)
192.168.6.38    **e8:9a:xx:xx:xx:xx**   Quanta Computer Inc. (DUP: 2)
192.168.6.47    18:03:xx:xx:xx:xx   Dell Inc
192.168.6.62    00:26:xx:xx:xx:xx   Wistron Corporation
192.168.6.77    2a:91:xx:xx:xx:xx   (Unknown)
192.168.6.78    e8:9a:xx:xx:xx:xx   Quanta Computer Inc.
192.168.6.95    40:16:xx:xx:xx:xx   (Unknown)
192.168.6.95    **e8:9a:xx:xx:xx:xx**   Quanta Computer Inc. (DUP: 2)
192.168.6.110   40:16:xx:xx:xx:xx   (Unknown)

My gateway is 192.168.6.1. All duplicate has same MAC address (MAC in **). I think it is a forged MAC because I try to find the machine and shutdown it but my network is still unstable. I think it is a starting point to find out what is happening but I am stucking to continue.

Best Answer

Given the constraints you've outlined in your comments above, all you can really do is leave an ARPping running to that MAC address, and unplug (then reconnect) the network leads from the switchgear, one-by-one, until the ARPping stops.

When the ARPping stops, that's the lead with the guilty piece of kit on the end. Yes, this is highly-disruptive to network operations; the business will have to make a decision as to whether persisting with the problem is more or less disruptive than finding it.

And yes, we are all familiar with business management who won't invest in improvements until there's a Dreadful Problem - and they then want it fixed at once. I'm sorry you've got such a set of managers; they're idiots.

Related Topic