Experimental Physics and
Industrial Control System

Michael Davidsaver <[email protected]> · Mon, 31 Oct 2016 11:51:23 -0400

On 10/31/2016 11:33 AM, Benjamin Franksen wrote:
> On 31.10.2016 15:30, Michael Davidsaver wrote:
>> On 10/31/2016 07:09 AM, Benjamin Franksen wrote:
>>> we finally found out what caused this strange behaviour. There was
>>> indeed a misconfiguration in the network: a new device was mistakenly
>>> copnfigured to use the same IP address as the IOC. For reasons that
>>> remain mysterious to me this condition was/is not detected by our
>>> network administrators. Instead we found out by trial and error and a
>>> bit of luck: someone had the idea to unplug the IOC and then issue a
>>> ping (which was answered by the 'imposter'). If the new device had been
>>> configured to not answer pings we would still be wondering...
>>
>> FYI, looking at the MAC in the arp cache of the client machine is a sure
>> way to detect this.
> 
> If you know what kind of problem to look for, yes. BTW I don't even know
> how to do that ("look at the arp cache"). For Linux I might find the
> answer to that with some googling but the problem manifested only on a
> Windows client.

Like 'netstat', this is a command which has some commonality in the *nix
and winsows worlds 'arp -a'.

https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/arp.mspx

In debian linux this is '/usr/sbin/arp'.

> Anyway, this sort of problem (duplicate IP adresses) should be detected
> automatically by the network infrastructure IMO, and not left to be
> debugged by control system engineers after they lead to obscure CA
> connection failures.

Oh, I completely agree!  However, I've been bitten by this, so I know
that detection (or notification of detection) isn't 100%.  I happened to
notice that the MAC in the arp cache was alternating between two values.

some relevant links

https://linux.die.net/man/8/arping

http://ipwatchd.sf.net

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System