Duplicate IPs and getting booted from network...

[Plymouthbreezer]

Can anyone tell me what's happening here? I keep getting deplicate IP warnings...

Dec  3 22:08:58 Ryans-Computer-2 kernel[0]: en0 duplicate IP address 172.25.3.186 sent from address 00:16:6f:2f:46:56
Dec  3 22:08:58 Ryans-Computer-2 configd[33]: DHCP en0: 172.25.3.186 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
Dec  3 22:09:01 Ryans-Computer-2 kernel[0]: AppleYukon2 - en0 link down
Dec  3 22:09:09 Ryans-Computer-2 kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
Dec  3 22:09:16 Ryans-Computer-2 kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
Dec  3 22:10:16 Ryans-Computer-2 mDNSResponder[21]: User updated Computer Name from Ryan's Computer to MacBook Pro
Dec  3 22:10:16 MacBook-Pro configd[33]: setting hostname to "MacBook-Pro.local"
Dec  3 22:10:17 MacBook-Pro mDNSResponder[21]: User updated Local Hostname from Ryans-Computer-2 to MacBook-Pro
Dec  3 22:10:28 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
Dec  3 22:10:57 MacBook-Pro com.apple.launchd[127] (com.apple.NetworkDiagnostics[279]): Check-in of Mach service failed. Already active: com.apple.NetworkDiagnostic.agent
Dec  3 22:10:58 MacBook-Pro kernel[0]: en0 duplicate IP address 172.25.12.14 sent from address 00:16:6f:2f:46:56
Dec  3 22:10:58 MacBook-Pro configd[33]: DHCP en0: 172.25.12.14 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
Dec  3 22:11:08 MacBook-Pro kernel[0]: AppleYukon2 - en0 link down
Dec  3 22:11:10 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
Dec  3 22:11:30 MacBook-Pro mDNSResponder[21]: Note: Frequent transitions for interface en0 (172.25.12.14); network traffic reduction measures in effect
Dec  3 22:11:31 MacBook-Pro kernel[0]: en0 duplicate IP address 172.25.12.14 sent from address 00:16:6f:2f:46:56
Dec  3 22:11:31 MacBook-Pro configd[33]: DHCP en0: 172.25.12.14 in use by 00:16:6f:2f:46:56, DHCP Server 10.0.2.15
Dec  3 22:11:41 MacBook-Pro kernel[0]: AppleYukon2 - en0 link down
Dec  3 22:11:49 MacBook-Pro kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
Dec  3 22:11:55 MacBook-Pro kernel[0]: AppleYukon2: 00000000,00000000 sk98osx_dnet - recovering from missed interrupt
Dec  3 22:16:10 MacBook-Pro kernel[0]: AppleYukon2 - en0 link active, 100-Mbit, full duplex, flow control disabled port 0
Dec  3 22:16:30 MacBook-Pro mDNSResponder[21]: CacheRecordAdd: _afpovertcp._tcp.local. (PTR) got immediate answer burst (10); restarting exponential backoff sequence (27054)
Dec  3 22:16:30 MacBook-Pro mDNSResponder[21]: CacheRecordAdd: _rfb._tcp.local. (PTR) got immediate answer burst (10); restarting exponential backoff sequence (27054)
Dec  3 22:16:56 MacBook-Pro /usr/sbin/ocspd[312]: starting

Any ideas? I'm on a college network... Have I been hacked?

 

[yg17]

I saw this all the time when I worked in my university's IT department. Some moron probably manually assigned his IP address instead of using DHCP, which booted you off the network. You haven't been hacked. Just send that log in to your help desk, or whatever they have, and someone will probably get a nice talking to from network security if your IT department is any good.

In the meantime, you can try to reboot your computer and see if it will pull a different IP address for you.

 

[Plymouthbreezer]

I saw this all the time when I worked in my university's IT department. Some moron probably manually assigned his IP address instead of using DHCP, which booted you off the network. You haven't been hacked. Just send that log in to your help desk, or whatever they have, and someone will probably get a nice talking to from network security if your IT department is any good.

In the meantime, you can try to reboot your computer and see if it will pull a different IP address for you.

I've restarted and still get the same message... It's odd. I've also plugged and unplugged my cable, since that should release my IP, but to no avail...

Than again, I am on right now; no real noticeable pattern to the occurrences.

 

[myjay610]

Looks like you were booted from one IP then you went to obtain a second IP and the same device said it had that second IP too...

Someone could be broadcasting gratuitous ARP packets and responding to all ARP requests at the same. Bonjour Auto-IP FTW.

 

[Plymouthbreezer]

Is there anyway to find out where 00:16:6f:2f:46:56 is located on the network?

 

[Les Kern]

Is there anyway to find out where 00:16:6f:2f:46:56 is located on the network?

Yes there is, but you can't do it. Ask the IT dept.

 

[marvin*1*2]

Yes there is, but you can't do it. Ask the IT dept.

mh, that's the mac address?
can you elaborate on how he could find out if he was the it dept please?

 

[Les Kern]

The way I do it is via HP tools I purchased for my network switches and AP's, and Workgroup Manager for OS X Server has a discovery component.. There are, however, tools available to discover MAC addresses, like Engineers Toolset. Of course once you HAVE a MAC address, what to do with it? Pretty much tells you nothing. If the IT department can discover what port it's connected to they may be able to trace it, but wireless access makes that pretty tough if not impossible. Maybe hope they have a Radius server where they could have registered address and the users machines that possess them.
Good luck!