Duplicate IPs and getting booted from network...

Discussion in 'Mac OS X Server, Xserve, and Networking' started by Plymouthbreezer, Dec 3, 2008.

  1. Plymouthbreezer macrumors 601

    Plymouthbreezer

    Joined:
    Feb 27, 2005
    Location:
    Massachusetts
    #1
    Can anyone tell me what's happening here? I keep getting deplicate IP warnings...

    Code:
    Dec  3 22:08:58 Ryans-Computer-2 kernel[0]: en0 duplicate IP address 172.25.3.186 sent from address 00:16:6f:2f:46:56
    Dec  3 22:08:58 Ryans-Computer-2 configd[33]: DHCP en0: 172.25.3.186 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
    Dec  3 22:09:01 Ryans-Computer-2 kernel[0]: AppleYukon2 - en0 link down
    Dec  3 22:09:09 Ryans-Computer-2 kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
    Dec  3 22:09:16 Ryans-Computer-2 kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
    Dec  3 22:10:16 Ryans-Computer-2 mDNSResponder[21]: User updated Computer Name from Ryan's Computer to MacBook Pro
    Dec  3 22:10:16 MacBook-Pro configd[33]: setting hostname to "MacBook-Pro.local"
    Dec  3 22:10:17 MacBook-Pro mDNSResponder[21]: User updated Local Hostname from Ryans-Computer-2 to MacBook-Pro
    Dec  3 22:10:28 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
    Dec  3 22:10:57 MacBook-Pro com.apple.launchd[127] (com.apple.NetworkDiagnostics[279]): Check-in of Mach service failed. Already active: com.apple.NetworkDiagnostic.agent
    Dec  3 22:10:58 MacBook-Pro kernel[0]: en0 duplicate IP address 172.25.12.14 sent from address 00:16:6f:2f:46:56
    Dec  3 22:10:58 MacBook-Pro configd[33]: DHCP en0: 172.25.12.14 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
    Dec  3 22:11:08 MacBook-Pro kernel[0]: AppleYukon2 - en0 link down
    Dec  3 22:11:10 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
    Dec  3 22:11:30 MacBook-Pro mDNSResponder[21]: Note: Frequent transitions for interface en0 (172.25.12.14); network traffic reduction measures in effect
    Dec  3 22:11:31 MacBook-Pro kernel[0]: en0 duplicate IP address 172.25.12.14 sent from address 00:16:6f:2f:46:56
    Dec  3 22:11:31 MacBook-Pro configd[33]: DHCP en0: 172.25.12.14 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
    Dec  3 22:11:41 MacBook-Pro kernel[0]: AppleYukon2 - en0 link down
    Dec  3 22:11:49 MacBook-Pro kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
    Dec  3 22:11:55 MacBook-Pro kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
    Dec  3 22:16:10 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
    Dec  3 22:16:30 MacBook-Pro mDNSResponder[21]: CacheRecordAdd: _afpovertcp._tcp.local. (PTR) got immediate answer burst (10); restarting exponential backoff sequence (27054)
    Dec  3 22:16:30 MacBook-Pro mDNSResponder[21]: CacheRecordAdd: _rfb._tcp.local. (PTR) got immediate answer burst (10); restarting exponential backoff sequence (27054)
    Dec  3 22:16:56 MacBook-Pro /usr/sbin/ocspd[312]: starting
     
    Any ideas? I'm on a college network... Have I been hacked?
     
  2. yg17 macrumors G5

    yg17

    Joined:
    Aug 1, 2004
    Location:
    St. Louis, MO
    #2
    I saw this all the time when I worked in my university's IT department. Some moron probably manually assigned his IP address instead of using DHCP, which booted you off the network. You haven't been hacked. Just send that log in to your help desk, or whatever they have, and someone will probably get a nice talking to from network security if your IT department is any good.

    In the meantime, you can try to reboot your computer and see if it will pull a different IP address for you.
     
  3. Plymouthbreezer thread starter macrumors 601

    Plymouthbreezer

    Joined:
    Feb 27, 2005
    Location:
    Massachusetts
    #3
    I've restarted and still get the same message... It's odd. I've also plugged and unplugged my cable, since that should release my IP, but to no avail...

    Than again, I am on right now; no real noticeable pattern to the occurrences.
     
  4. myjay610 macrumors regular

    Joined:
    Jan 6, 2008
    #4
    Looks like you were booted from one IP then you went to obtain a second IP and the same device said it had that second IP too...

    Someone could be broadcasting gratuitous ARP packets and responding to all ARP requests at the same. Bonjour Auto-IP FTW.
     
  5. Plymouthbreezer thread starter macrumors 601

    Plymouthbreezer

    Joined:
    Feb 27, 2005
    Location:
    Massachusetts
    #5
    Is there anyway to find out where 00:16:6f:2f:46:56 is located on the network?
     
  6. Les Kern macrumors 68040

    Les Kern

    Joined:
    Apr 26, 2002
    Location:
    Alabama
    #6
    Yes there is, but you can't do it. Ask the IT dept.
     
  7. marvin*1*2 macrumors member

    marvin*1*2

    Joined:
    Jun 19, 2007
    Location:
    Yrp!
    #7
    mh, that's the mac address?
    can you elaborate on how he could find out if he was the it dept please?
     
  8. Les Kern macrumors 68040

    Les Kern

    Joined:
    Apr 26, 2002
    Location:
    Alabama
    #8
    The way I do it is via HP tools I purchased for my network switches and AP's, and Workgroup Manager for OS X Server has a discovery component.. There are, however, tools available to discover MAC addresses, like Engineers Toolset. Of course once you HAVE a MAC address, what to do with it? Pretty much tells you nothing. If the IT department can discover what port it's connected to they may be able to trace it, but wireless access makes that pretty tough if not impossible. Maybe hope they have a Radius server where they could have registered address and the users machines that possess them.
    Good luck!
     

Share This Page