Few network issues cause more confusing and intermittent symptoms than duplicate IP addresses and mismatched subnet masks. When two computers are accidentally assigned the exact same IP address, both machines may function normally for a few minutes, only to have their connections randomly drop, freeze, or hijack each other's sessions. To an untrained user, the network appears possessed by a ghost.
Similarly, when two communicating hosts share the same physical switch but are configured with different subnet masks, one computer may believe the other is local, while the second computer believes the first is remote. This creates an asymmetric routing failure where packets flow out but replies never return. In this chapter, you will analyze these subtle Layer 3 anomalies and learn how to resolve them definitively.
How Duplicate IP Address Collisions Occur
Every IP address in an active subnet must be unique. When Host A and Host B share the same IP address (for example, 192.168.1.50), a race condition erupts inside the local switch's MAC address forwarding table (CAM table) and the gateway router's ARP cache.
Here is what happens behind the scenes during an IP collision:
- When Host A transmits a frame, the switch associates IP 192.168.1.50 with Host A's MAC address on port 1.
- Seconds later, Host B transmits background traffic. The switch overwrites its table, associating 192.168.1.50 with Host B's MAC address on port 5.
- When the gateway router sends a packet to 192.168.1.50, the packet is forwarded to whichever host transmitted most recently!
Modern operating systems run Gratuitous ARP (GARP) detection upon boot. The computer broadcasts an ARP request for its own newly assigned IP address. If another host answers, the computer warns the user: "An IP address conflict was detected on the network," and shuts down its own network stack to prevent further disruption.
| Anomalous Condition | Layer Involved | Primary Observable Symptom | Root Cause Mechanism |
|---|---|---|---|
| Duplicate IP Collision | Layer 2 and Layer 3 | Intermittent 50% packet drop; flapping connections | Two distinct MAC addresses responding to single IP |
| Mask Too Short (/24 vs /26) | Layer 3 | Sends ARP for remote hosts instead of using gateway | Host assumes target is local; gateway is bypassed |
| Mask Too Long (/27 vs /24) | Layer 3 | Sends packets to gateway for actually local neighbors | Host assumes local neighbor is in a foreign subnet |
| Stale ARP Cache | Layer 2 | Packets routed to decommissioned old server hardware | Cache retains expired IP-to-MAC association |
The Anatomy of Subnet Mask Mismatches
A subnet mask determines where the network boundary ends and the host portion begins. Consider two hosts physically connected to the same switch:
- Workstation 1: IP
192.168.1.10with mask255.255.255.0 (/24). Network range: 192.168.1.0 to 192.168.1.255. - Workstation 2: IP
192.168.1.150with mask255.255.255.128 (/25). Subnet 0: .0 to .127. Subnet 1: .128 to .255.
When Workstation 1 pings Workstation 2, it performs a binary AND operation using its /24 mask. It concludes: "192.168.1.150 is on my local subnet!" It broadcasts an ARP request, receives an ARP reply, and delivers the ICMP Echo Request directly across the switch.
However, when Workstation 2 attempts to reply, it performs a binary AND operation using its /25 mask. It calculates its local subnet boundary as 192.168.1.128 to .255, and concludes: "192.168.1.10 is in an external foreign network! I must send my reply to the default gateway." If the default gateway is down or lacks a return route, the reply is dropped, creating a baffling one-way communication failure!
Hands-On Lab Practice
In this lab exercise, you will investigate an office network plagued by an IP address conflict and a subnet mask mismatch. You will inspect the ARP cache tables on both workstations, identify the conflicting MAC addresses, align subnet masks to a consistent /24 boundary, and confirm that both devices achieve stable, uninterrupted communication.
Keep the simulator terminal open. Use arp -a to inspect dynamic MAC address mappings before and after resolving the conflict.