Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
On my work network, when I go to my DHCP server, then open DHCP > domain_name > IPv4 > Address Leases, I found that 192.168.160.7 is assigned to a iPad device (connected via Wifi).
When I use command prompt and type "arp -a" I found that 192.168.160.7 is mapped to a MAC address which is a desktop computer.
How is this possible? How do I know which device really has that IP?
Thank you in advance!
It is possible your PC has an old ARP entry in the table. If the PC did not perform an ARP request for this IP address recently, while the IP was assigned to a new device.
If you ping the address, your ARP table should update with the new MAC address after the original ARP entry has expired due the aging timer.
This is of course, providing you do not have an IP conflict and the desktop has a static IP address assigned while the DHCP gave out the same IP address to another device.
If you ping the address, your ARP table should update with the new MAC address in your answer is incorrect. In the situation that you describe in the answer (when the ARP cache contains an entry) the ping will not trigger an ARP request.
You aren't providing a lot of information to go on, but I will assume this is a relatively simple flat network.
How is this possible?
There are a few possible causes.
You may have an IP conflict on your network. One device (the iPad) is learning it's IP address from DHCP. The desktop is configured to use a static IP address instead of DCHP. Both are trying to use the same address.
It is also possible that the DHCP server/service was restarted and doesn't maintain state between restarts (i.e. many consumer devices). It may have provided the IP address to the desktop prior to the restart, then provided it to the iPad after the restart. The desktop will still think it has a right to the IP address for however long it was given the lease. This also results in an IP conflict, but it will resolve itself when the desktop goes to renew it's DHCP lease.
The other option is that the device you ran your "arp -a" command on has a outdated entry for the IP address referencing the desktop. Most devices only maintain dynamic ARP entries for a relatively short period of time (a few minutes), so you may have just happened on a normal situation in the relatively narrow window it could exist. Or potentially, you could have an outdated static ARP entry on the device you ran your "arp -a" command, but this is unlikely unless your environment normally makes use of static ARP entries.
How do I know which device really has that IP?
Likely both devices have that IP address (first two reasons above) which will cause problems. How to deal with it depends on the situation.
Easiest is if the DHCP service was restarted and both devices learned the IP from DHCP. This will either resolve itself given time, or you can force the desktop to request an IP address (disconnect and reconnect it to the network or use a method present in the OS such as "ipconfig /renew" from the Windows command prompt).
If the desktop is configured with a static IP address, you would need to determine if it should be configured statically or not. If yes, then the IP address should be removed from the DHCP pool of addresses so the DHCP server does not assign it to another device. If no, then the desktop should be configured to use DHCP to learn it's IP address.
Finally, if you have an old ARP entry, either wait a couple minutes (most dynamic ARP entries have fairly short aging periods) or a static ARP entry would need to be removed.
