I have a Core Switch (routing capability) connected to two access switches. Each switch has a computer connected to it with the same IP and same VLAN. The Core Switch operates as a Level 3 device. All switches are HP/Aruba. Is it possible that the core switch shows some entry in the logs about a duplicate IP?

I know that if any of the switches had a duplicate IP there would be a warning in the logs, but does the same thing happen with other equipment?


Most probably not, depending on the actual model.

This is not the task of a switch to detect such an error.

From a layer 2 perspective, the two hosts have different MAC addresses so no issue.

At layer 3, when sending packet to the IP address the switch will perform an ARP request and will pick whichever host answer first then will send the frame to this host. When the arp cache expire, the process repeat and there's a (roughly) 50% chance that the other host mac address will be picked.

This will result in disruption in communication for both hosts, but all this isn't abnormal operations for the switch itself. Some switch may detect the flapping and complain, but this will be very model / firmware dependent.

Note: if the hosts were directly connected to the core switch, this wouldn't change the behavior.

| improve this answer | |
  • I didn't actually indicate if he was using those level 3 capabilities. He's using them, he's acting as a level 3 device. – Qkolnek Jun 8 at 15:34
  • I just changed the question to include that the Core Switch is acting as a level 3 device. – Qkolnek Jun 8 at 15:42
  • "The Core Switch operates as a Level 3 device." It only does so when routing into or out of the VLAN. Inter-VLAN traffic doesn't use L3 switching. – Zac67 Jun 8 at 16:50

In addition to JFL's answer:

In order to remove duplicate IP addresses, you might want to check out dhcp-snooping.

It snoops for DHCP leases and puts them in a table used for the arp-protect option that forces nodes to use the DHCP address obtained by a trusted DHCP server. arp-protect doesn't actually check all packets for correct MAC-to-IP usage but it only permits ARP responses that fit ARP-cache entries and drops invalid responses.

While the ARP cache is usually populated by DHCP snooping, you can also set up static entries for trusted nodes not using DHCP.

Of course, you can also have invalid ARP responses trigger SNMP traps or just have them logged.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.