Duplicate IP Address Scanning

Duplicate IP addresses sometimes occur on an IPv4 network subnet if a device is added that already has a static IP address assigned to it. Operating systems like Windows can detect this, but this detection normally happens when the OS is starting up. If a duplicate occurs, ARP reply packets return to a sender (who send ARP discovery) from two sources, both with the same IP but with different MAC addresses. We have a tool in NetScanTools Pro that can scan your whole subnet and look for duplicate IP responses. It will show the MAC address, Interface Manufacturer and Hostname of the duplicate devices.

Here is an example of what happens when a duplicate is found:

Demonstration Video:



This tool is quick and easy to use, you simply enter the IP address range, select the WinPcap compatible interface that is found in the IP address range and start it. If you have a large range like a 10.x.x.x, it may take a long time to complete and I would suggest breaking the range up into ranges where you know devices exist.

To learn more about the Duplicate IP Address Scanner tool and to download a demo with this tool fully active, please visit this page NetScanTools.com

TIP: Managed Switch Port Mapping Tool Update Check

The Managed Switch Port Mapping Tool has a method for checking for updates that simply grabs a small file from our website, then checks the running version against what the file indicates is the latest version. That works fine for interactive (manual) mode, but if you are using the software from the command line on a scheduled basis, it would be better if you turned off the version check.

How to turn the version check on or off:

1. Start the Managed Switch Port Mapping Tool and press the Global Settings button on the left panel. See the screenshot from v2.21 below.
2. 'Uncheck' the box labeled Enable Internet Software Version Check.

If you do turn it off, you might consider signing up for our new version notification email by clicking on Help/New Release Notification Signup or manually checking for a new version once a month by clicking on Help/Check for Update. Otherwise you may be stuck with an old version for a long, long time.

Managed Switch Port Mapping Tool v2.21 released December 20, 2013

This is an important release - especially if you rely on the history database (history.db3) for anything. There was a problem writing multirow mac address, IP address, hostname and interface manufacturer cells (ports with several devices attached to them, like other switches) to the history database. This has been corrected along with several other minor changes. I also move to address an issue with SQLITE_BUSY message handling, so if you are on a slow computer with a slow hard drive, it should work better for you.

You can download this release from http://www.SwitchPortMapper.com/ or from NetScanTools.com. We've also recently added an FTP link for those of you with a strange problem downloading using older versions of Internet Explorer. FTP seems to work, while HTTP on old IE sometimes results in a corrupted zip file. I have no idea why that's happening because the problem shows up for those people no matter which site they download from. Strange.

This release has been fully tested on Windows 8.1, 7 and XP. Other operating systems newer than XP should work fine.

Here is the list of detailed changes:
-Corrected problem saving multirow cells (ports with 2 or more attached mac addresses) to the history database. This affects MAC Address, IP Address, Hostname and Interface Manufacturer columns.
-Changes to SQLite interface to better handle the rare occurrence of SQLITE_BUSY messages.
-Improved retrieval of serial number, model number and software versions from Netgear switches.
-Added analysis of used/unused Gigabit Ethernet (type 117) ports on a switch.
-Added new table to history database saving the dot1dBasePortIfIndex for future use.
-Added checkboxes to control the visibility of the auth and priv passwords in the SNMPv3 settings window.
-Added warning to SNMPv3 settings window regarding AuthPriv mode when the database is unprotected.
-Improved SNMPManager utility to better check versions of libeay32.dll.
-Updated SQLite to version 3.8.2
-Updated MAC address/Manufacturer database.

Important NetScanTools Pro v11.53 Release

NetScanTools Pro v11.53 (installed) was released on November 1, 2013. This is a very important release because of the type of fixes that are in it. These fixes affect any of the tools that use WinPcap for capturing or sending packets. The WinPcap fixes are important if you use NetScanTools Pro on a machine where the network interface does not support promiscuous mode (normally WiFi 802.11) or you have more than one network interface on the machine.

If your network interface does not support promiscuous mode, all versions prior to 11.53 will not be able to open the interface resulting in a message similar to this one: "Error: Cannot open interface for packet sending. Please exit and restart NetScanTools Pro".

This means you cannot fully utilize tools that depend on WinPcap - for example the WinPcap ICMP mode of Traceroute will not work. The change in 11.53 allows the interface to be automatically opened in non-promiscuous mode if the open in promiscuous mode fails. If an adapter can be opened in promiscuous mode, all packets passing by it are passed along to the host system, however, if it is opened in 'normal' mode, then only packets intended for the system are passed to the host system. This mostly affects WiFi adapters so now you may find that NetScanTools Pro works much better with your WiFi network interface. Error message reporting has been significantly improved at the same time.

If you have more than one network interface on the system running NetScanTools Pro, all versions prior to 11.53 will only be able to send packets to the local network associated with the secondary interface. In other words if a packet sent out the secondary interface is intended for a destination beyond the default gateway, it will not get there because the default gateway mac address was not being obtained correctly. It now is obtained correctly so packets will go out the secondary interface default gateway as intended.

The WinPcap related changes affected ARP Ping, ARP Scan, Duplicate IP Address Scanner, OS Fingerprinting, Packet Capture Playback, Packet Generator, Ping, Port Scanner, Promiscuous Mode Scanner, Traceroute, Connection Monitor, Packet Capture, Passive Discovery, SNMP Dictionary Attack and SNMP Scanner.

Other changes include:

1. The improvement of administrator privileges detection which affects TimeSync - doing a clock synchronization and DNS Tools Core Edit Hosts File. Some portions of Network Connection Endpoints are also affected.
2. Addition of a column showing the DHCP Server MAC Address to the DHCP Server Discovery Tool.
3. Packet Capture Playback now supports sending .pcap files in addition to .cap files.
4. Ping Enhance/TCP Ping now correctly send the number of packets you designate.
5. SQLite was updated to 3.8.1 and the database files were updated.

Version 11.53 is available to all those will active maintenance plans. Click on Help/Check for New Version to obtain it.

Opening a WinPcap Compatible Network Interface

Sometimes a network interface is WinPcap compatible meaning it can be opened with WinPcap, but opening it with the methods found in the example code for developers can fail. The examples usually show opening the interface using the PCAP_OPENFLAG_PROMISCUOUS. While that normally works fine for wired interfaces, wireless interfaces (WiFi 802.11) may not open - in fact according to a Winpcap-users post from 2008 regarding v4, "most of the wireless cards do not support promiscuous mode. The call to pcap_open with PCAP_OPENFLAG_PROMISCUOUS should fail" - see http://www.winpcap.org/pipermail/winpcap-users/2008-June/002532.html

Here is typical code from the examples:

pcap_t *hDev = pcap_open(deviceName, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, errMsg1);

If it fails to open because the interface cannot support promiscuous mode, hDev is NULL and errMsg1 will contain a string like this: "failed to set hardware filter to promiscuous mode".

A good way of dealing with this is to first try opening the interface, then if hDev is NULL try opening it without the flag:

hDev = pcap_open(deviceName, 65536, 0, 1000, NULL, errMsg2);

Then if hDev is still NULL, report both errMsg1 and errMsg2 to the user. If they both fail you will need to avoid doing any further winpcap function calls except to do pcap_freealldevs because you most likely uses pcap_findalldevs_ex before trying to open an interface and it allocates the device list from which deviceName was found.

Why is opening an interface in promiscuous mode important? When a network interface card (NIC) is opened in promiscuous mode, all packets seen by the interface are captured and passed to the host system, while an interface opened normally only captures packets strictly intended for it alone. So if you are running a utility like NetScanTools Pro Packet Capture or Wireshark, you will most likely want to be running in promiscuous mode so you can see all the packets passing by the interface.

Applicability:
WinPcap v4.1.3 is the most current version as of this discussion. Please visit http://www.winpcap.org/

Managed Switch Port Mapping Tool v2.13 released Oct 10, 2013

I debated as to whether this should be 2.13 or 2.2 because normally a .2 release would mean new features. This release has new features, but in the end I settled on 2.13 because most of the changes were fixes to the LLDP and CDP columns.

The new features are showing the Switch Alias that you have created for a switch when you view the Left Panel/Select Config or Switch Lists/Edit Switch Config. This makes it much easier to see which switch you are wanting to deal with as opposed to seeing only the switch IP address.

The LLDP changes were numerous. First of all, LLDP is not indexed by ifIndex, it's indexed by any of a number of ways. Usually by the interface name, description or alias. It now works much better and will provide LLDP info in the right cell for most indexing options. The other big issue for LLDP was the IP address. Previously we were using the MAC address which is almost always sent in LLDP to lookup the IP in the database. But that didn't always work. So now if the switch has extended LLDP info, we get the IP address of the attached device from the switch LLDP data. In fact, we show them both and indicate the source of the IP address. IPv4 and IPv6 are supported from the extended LLDP info. Another problem with the previous way we reported LLDP was that if the field had no information, it was simply left blank. Now, in keeping with the way Cisco does it from CLI (show lldp neighbors), we use the statement 'not advertised'. That way you know that the data was not available to us.

The statement 'not advertised' was also extended to CDP, which by the way is indexed by ifIndex. There was also a correction to the parsing of the device capabilities field from CDP. You should not see 'unknown' very often any longer.

There was one other change to the number of rows displayed. You may see more loopback rows or similar. And as usual, the MAC Address to Manufacturer database was updated.

Please visit http://www.SwitchPortMapper.com/ to download the latest version 2.13.

NetScanTools Pro v11.52 Released Sept 24, 2013

NetScanTools Pro 11.52 was released last week and it has several improvements and updates the databases.

Packet Generator will now work better on Windows 8.x in that the operating system will no longer think it is 'not responding' while sending streams of packets. Earlier versions of Windows do not get confused like this, but apparently Windows 8 expects the message queue to be pumped more often. If the message queue is not cleared quickly enough Windows 8 grays out the software and calls it 'non-responding' which clearly was not the case with the Packet Generator.

Several things were done in Ping and Traceroute to give the user better feedback when the Windows Firewall settings are not allowing outgoing packets to be captured by WinPcap. Without knowing when the outgoing packets are sent, it's difficult to establish round-trip-time. A message will now appear explaining the problem and telling you to change the firewall settings or temporarily turn it off. The timing calculation shown in the analysis area below the results grid now shows sub-decimal timing calculations, ie. 123.456 ms instead of just 123 ms.

The Wireless Network Interface tool now has more concise explanations of what was found to better conform to industry standard terminology.

The USB version has a change that only affects the USB version: if the host has WinPcap 4.1.2 or 4.1.3 installed on it, the software uses the host's WinPcap instead of the WinPcap Pro that is on the USB. More about this in another blog post soon.

If you have an active maintenance plan, please start NetScanTools Pro, then click on Help/Check for New Version to access either the new v11.52 full install or USB upgrade patch.