Under what circumstances could two completely different machines receive packets at the same class C IP address that is not within the IANA-reserved private IPv4 network ranges?
closed as not a real question by Iszi, Jeff Ferland♦, Steve, this.josh, Hendrik Brummermann♦ Oct 19 '11 at 7:05
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.
It would help if you were more clear about the topology of what you're discussing, but on the face of it my first guess is that your switch was forwarding packets to multiple ports and figured it out after a little while.
1) More info from above helps. Packet dumps really help.
3) Dependent on 2.
This is not necessarily a failure condition that you are describing. In fact, depending on your environment this may be completely normal behavior.
My first assumption would be a DHCP lease transition, this is common in highly utilized pools. As such I would go through the logs looking for the appropriate EXPIRE/RELEASE/DISCOVER events and build out a timeline.
Another option could be the fail-back condition of a switch. When a switch does not know which port a MAC address can be found on, it transmits the packet out all switches. In other words, reverting to hub behavior. Granted, this would result in all systems receiving packets for the given system. However, this is often detected by accident because one individual happens to start a packet capture before the MAC is learned by the switch. This most often occurs when dealing with UDP packets, such as a syslog receiver. When the target receives packets consistently, but rarely transmits. As such, the CAM entries age out.
If neither of those options pan out, then I would assume malicious intent. Arp poisoning would be the most likely candidate. How one goes about finding the target depends heavily , exclusively?, upon your infrastructure and what network management/monitoring tools you have in place.