Duplicate printer IP address

[tsbservice]

Just yesterday had a call from IT guy that machine (KM in this case if that matters) stopped to print.
They checked driver, port, cable, etc. There was ping reply but no printer web page interface. I told them try to scan to email which he thinks was failing either but upon last attempt he saw message on machine that job failed due to duplicate IP I was on the phone and we run advanced IP scanner (after turning Off the machine) which found some PC taking over machine IP. Lesson again and again learned... never trust customers

[blackcat4866]

Re: Duplicate printer IP address

The first time this came up for me, it was a Copystar VoyagerE. The endusers told me that they could send print jobs all day, and nothing would print. Then around 1545 in the afternoon all the print jobs would come pouring out of the machine.

It took only a few minutes to unplug the network cable and connect my laptop there. NetScan revealed that yes, there as a laptop using that IP. Later on I found out that it was an employees personal laptop with a static IP set, that happened to be within range of the existing wireless router.

I think the reaction of the on-staff IT guy was the funniest part. He said: "That's impossible! I assign the IP's and I didn't assign that to any laptop!" "NetScan tells me the MAC address is: xx..., according to my list it's a xxx branded laptop. I can't tell you where it's at, but I can tell you it's still on the network now." =^..^=

[slimslob]

Re: Duplicate printer IP address

I had the same thing at a county water agency office in Tehachapi. It was a new install and their new local Tehachapi IT had given me an IP address to use, in the past we had always just used the same IP as the machine being replaced. He had me change the address, twice, and the same with all 3. FYI, all 3 were in consecutive order. He hadn't been onsite yet so I used a couple of network tools and discovered there was a WAN setup using those 3 addresses for remote access. Kern County Information Services, who had been doing the IT previously, had set it up to allow them to administer the network and allow the main county water agency to check daily reports.

[techsxge]

Re: Duplicate printer IP address

Just yesterday had a call from IT guy that machine (KM in this case if that matters) stopped to print.
They checked driver, port, cable, etc. There was ping reply but no printer web page interface. I told them try to scan to email which he thinks was failing either but upon last attempt he saw message on machine that job failed due to duplicate IP I was on the phone and we run advanced IP scanner (after turning Off the machine) which found some PC taking over machine IP. Lesson again and again learned... never trust customers

Thats why you configure DHCP Ranges and put the machine outside of that range + have a documenation on hand for the non-dhcp ranges

[slimslob]

Re: Duplicate printer IP address

Thats why you configure DHCP Ranges and put the machine outside of that range + have a documenation on hand for the non-dhcp ranges

And you still have the problem of someone connecting their personal laptop using a manually address that is the same as the MFP.

[tsbservice]

Re: Duplicate printer IP address

And you still have the problem of someone connecting their personal laptop using a manually address that is the same as the MFP.

They should have reserved in DHCP IP addresses of MFPs by their MAC address which they didn't... till now.
I think this is among simple best practices of IT staff but who em I

[larweedad]

Re: Duplicate printer IP address

I had one where copier said ip in use. Turned out that the person in charge took a 2 week vacation. when they were in the office no printing. They leave it prints. They standing next to me. Their phone picked up the copiers IP when the came back from vacation.

[techsxge]

Re: Duplicate printer IP address

And you still have the problem of someone connecting their personal laptop using a manually address that is the same as the MFP.

Nope. Well, if you're doing very basic static IP via the said Machines / Computers then yes. I am talking about proper Static IP via Firewall/DHCP Server or Router. These things will bind a IP Address to an MAC Address which cannot be doubled.

[slimslob]

Re: Duplicate printer IP address

Nope. Well, if you're doing very basic static IP via the said Machines / Computers then yes. I am talking about proper Static IP via Firewall/DHCP Server or Router. These things will bind a IP Address to an MAC Address which cannot be doubled.

Many times an employee connecting their personal laptop don't have permission to do so and as such do not want to get an address automatically as it would then show up in the DHCP log.

[techsxge]

Re: Duplicate printer IP address

Many times an employee connecting their personal laptop don't have permission to do so and as such do not want to get an address automatically as it would then show up in the DHCP log.

For personal Devices, there will always be a guest network for as long as i am around. There, they can fight over any ip address they want with themselves but i dont care if they say "ip x is blocked". No personal device has anything to do in a companies network. NEVER. Had seen way too many companies been hacked because a Employees private Notebook got hacked and they shared files from that notebook with colleagues. That is kind of like putting the banks safe key next to the door.
If they need a static IP in that Guest Network for their device for whatever reason no problem, i'll add that.

[BillyCarpenter]

Re: Duplicate printer IP address

There's another way to do this and it's probably the best method, IMHO. You can bind a mac address, or two, to a specific port on the switch. If someone comes along and plugs in a laptop or other device, the port immediately shuts down and the IT dept is notified via email.

You can also do some other cool stuff but we'll save that for another day.

[techsxge]

Re: Duplicate printer IP address

There's another way to do this and it's probably the best method, IMHO. You can bind a mac address, or two, to a specific port on the switch. If someone comes along and plugs in a laptop or other device, the port immediately shuts down and the IT dept is notified via email.

You can also do some other cool stuff but we'll save that for another day.

Isnt an IT Email and shutting off the port kinda an overkill? Just denying any traffic would be more than enough

[BillyCarpenter]

Re: Duplicate printer IP address

For personal Devices, there will always be a guest network for as long as i am around. There, they can fight over any ip address they want with themselves but i dont care if they say "ip x is blocked". No personal device has anything to do in a companies network. NEVER. Had seen way too many companies been hacked because a Employees private Notebook got hacked and they shared files from that notebook with colleagues. That is kind of like putting the banks safe key next to the door.
If they need a static IP in that Guest Network for their device for whatever reason no problem, i'll add that.

What are you talking about? A wireless guest network?

I thought we were talking about plugging a device (laptop or otherwise) into an ethernet port?

[BillyCarpenter]

Re: Duplicate printer IP address

Isnt an IT Email and shutting off the port kinda an overkill? Just denying any traffic would be more than enough

Well, lets think about it. If a company has highly classified information stored on their server, wouldn't you want to be notified the second an unauthorized device was plugged in and that port be shut down immediately? That's why switches have this feature.

[BillyCarpenter]

Re: Duplicate printer IP address

techxsge asked a good question: Why would you want to shut down a port...isn't that overkill? Good question.

I remember when I was going thru CCNA course on Port Security, they brought up an interesting scenario. Some may find this interesting. Forget about an employee bringing in a laptop. Let's focus on a hacker trying to steal sensitive information. What if the hacker is using an Attack Tool that is flooding the switch with Mac Addresses? Remember that a switch has a Mac Address Table that is stored in memory. The attack tool can flood the switch with 1000's of mac addresses in a short amount of time. This will cause flood the memory and the switch will forget all of the good mac addresses and bring down the entire system. Moreover, the hacker can now intercept all known good mac addresses and use a mac spoofing tool. It's bad news.

From my understanding, Port Security is used in all major organizations.