1

Using arp-scan to get a list of returned duplicate IP address. However, arp-scan will list duplicate IP with the same MAC address. I get a sorted output of asx.txt (shortened for brevity)

arp-scan 172.16.0.0/16 > as.txt
sort as.txt > as2.txt
cat as2.txt | uniq -D -w 36 > asx.txt
kye-mgmt02:/data # cat asx.txt
  172.16.150.68   d8:cb:8a:b0:6a:12       Micro-Star INTL CO., LTD.
  172.16.150.68   d8:cb:8a:b0:6a:12       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.69   00:23:24:9e:3d:32       G-PRO COMPUTER
  172.16.150.69   00:23:24:9e:3d:32       G-PRO COMPUTER (DUP: 2)
  172.16.150.70   00:23:24:9e:3d:82       G-PRO COMPUTER
  172.16.150.70   00:23:24:9e:3d:82       G-PRO COMPUTER (DUP: 2)
  172.16.150.71   d8:cb:8a:86:2f:56       Micro-Star INTL CO., LTD.
  172.16.150.71   d8:cb:8a:86:2f:56       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.72   d8:cb:8a:cf:f1:e8       Micro-Star INTL CO., LTD.
  172.16.150.72   d8:cb:8a:cf:f1:e8       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.73   d8:cb:8a:cf:f1:5d       Micro-Star INTL CO., LTD.
  172.16.150.73   d8:cb:8a:cf:f1:5d       Micro-Star INTL CO., LTD. (DUP: 2)

So as you can see, all the IPs are really not duplicated because the IPs have the same MAC address

to really find a duplicate IP with a different MAC, I edited the file and change the MAC of the last IP.

kye-mgmt02:/data # cat asx.txt
  172.16.150.68   d8:cb:8a:b0:6a:12       Micro-Star INTL CO., LTD.
  172.16.150.68   d8:cb:8a:b0:6a:12       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.69   00:23:24:9e:3d:32       G-PRO COMPUTER
  172.16.150.69   00:23:24:9e:3d:32       G-PRO COMPUTER (DUP: 2)
  172.16.150.70   00:23:24:9e:3d:82       G-PRO COMPUTER
  172.16.150.70   00:23:24:9e:3d:82       G-PRO COMPUTER (DUP: 2)
  172.16.150.71   d8:cb:8a:86:2f:56       Micro-Star INTL CO., LTD.
  172.16.150.71   d8:cb:8a:86:2f:56       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.72   d8:cb:8a:cf:f1:e8       Micro-Star INTL CO., LTD.
  172.16.150.72   d8:cb:8a:cf:f1:e8       Micro-Star INTL CO., LTD. (DUP: 2)
  172.16.150.73   d8:cb:8a:cf:f1:5d       Micro-Star INTL CO., LTD.
  172.16.150.73   d8:cb:8a:cf:f1:55       Micro-Star INTL CO., LTD. (DUP: 2)

Looking on how to output the duplicate IPs with different MACs

expected output

  172.16.150.73   d8:cb:8a:cf:f1:5d       Micro-Star INTL CO., LTD.
  172.16.150.73   d8:cb:8a:cf:f1:55       Micro-Star INTL CO., LTD. (DUP: 2)

I can't seem to find the right options to output the duplicate IPs with different MACs

Help please.

**tried

cat asx.txt | uniq -D -s 15 -w 33
cat asx.txt | uniq -D -s 15 -w 17-33
cat asx.txt | uniq -D -f1 -w 33
cat asx.txt | uniq -D -f1 -w 32
cat asx.txt | uniq -D -f1 -w 31
cat asx.txt | uniq -D -f1 -w 30
cat asx.txt | uniq -D -f1
cat asx.txt | uniq -D -s 15

But none gives the desired output.

Improve this question
0

1 Answer 1

Reset to default
0

The DUP: tag on each line is not helping you. It causes two lines to be different, when you would like to consider them identical. Two ways around this are to either 1) consider ONLY the IP address and MAC address; or 2) remove the DUP: tag before looking for uniqueness.

Here's one way to pursue method 1:

$ awk '{print $1 " " $2}' < asx.txt | uniq -u
172.16.150.73 d8:cb:8a:cf:f1:5d
172.16.150.73 d8:cb:8a:cf:f1:55

Here's one way to pursue method 2:

$ sed 's/ .\(DUP: .*\)$//' < asx.txt | uniq -u
172.16.150.73   d8:cb:8a:cf:f1:5d       Micro-Star INTL CO., LTD.
172.16.150.73   d8:cb:8a:cf:f1:55       Micro-Star INTL CO., LTD.
Improve this answer
2
  • Thanks Jim - used method 2 in my script which usually doesn't show any duplicate IPs, but will if from 2 different nodes.
    – user552826
    Commented Dec 13, 2022 at 18:31
  • @JohnGoutbeck After you've tried it out, please up-vote and accept the answer if it proves useful. Thank you!
    – Jim L.
    Commented Dec 13, 2022 at 19:50

You must log in to answer this question.