Is there an ip conflict detector for linux?

vitugv · 09-30-2007, 07:30 PM

On a linux server, is there an application or feature that would warn if the ip address being used has been hijacked by another device like an XP workstation ?

Simon Bridge · 09-30-2007, 07:33 PM

http://ipwatchd.sourceforge.net/

... I understand there is one in the kernel anyway.

vitugv · 10-01-2007, 05:31 AM

If there is, neither I nor Dell Support found any sign of it on RHEL3. Went through 2 1/2 days of horror replacing integrated motherboards, going over configurations, tests ,etc.
Even had someone use a sniffer to check out ip traffic (I wonder if the guy was competent, though. Should he have seen it?).

Finally discovered the problem when I decided to bite the bullet, build a replacement server and tried to reuse the ip address. Turns out an outside consultant modifed an xp workstation using my static address, totally unauthorized, of course.

Simon Bridge · 10-03-2007, 03:37 AM

what was wrong with ipwatchd?

Quote:

IPwatchD is simple daemon that uses libpcap to detect IP conflict on Linux. It can be configured to listen on one or more interfaces (alias interfaces are also supported) in active or passive mode. In active mode IPwatchD protects your host before IP takeover by answering Gratuitous ARP requests received from conflicting system. In passive mode it just records information about conflict through standard syslog interface.