ENBT duplicate IP

I would like to get an advice on my issue.
We have many 1756-ENBTs cards in our site and those cards are connected to Network using MOXA switches. Sometime lost communication from ENBT and found Duplicate IP.
This is event happened many times in different area, i mean in different ENBTs cards Not only in one card. Moreover we have different VLANs in our system, means this issue it happened in different VLANs not only in one site.
We are sure there is No IP addresses are same in the network.
Anybody has an experience with ENBT and MOXA switches?
I am not sure it this issue is with ARP packets!!!
What is the ARP that ENBT uses to detect duplicate IP??

I appreciate your advice on this issue.

A story:

I have a similar problem every day on my community WiFi network. Every time our mesh access points reboot (every morning at 0300) they default to 192.168.1.1 until they finish applying their saved nonvolatile parameters. This causes a duplicate IP error on the main router.

And yet I could look at the system while it's running and swear on a stack of User Manuals that there are no duplicate IP addresses configured in the system.



RA added a duplicate IP incident diagnostic feature to the 1756-ENBT in version 6.001 firmware, in which it will actually give you the MAC ID of the device that answered the ARP packet the ControlLogix sent out.

It's described in this RA Knowledgebase document:

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/118216

It's possible there is a latent bug or something about the combination of your ControlLogix controllers and your MOXA switches. To diagnose it you're going to have to get deeply involved with tools like protocol analyzers.

I consider this unlikely, because duplicate IP detection is a well understood and generally stable feature of all embedded network platforms.

But I don't use the word 'impossible' often.

Thanks Ken Roach,

this issue it happened in diferent versions of 1756-ENBTs, in versions 6.001 firmware as well as in versions 4.0.
and it showed only 00:00:00:00: as MAC address.

do we can read the ARP from the ENBT card

regards,

We have sporadically experienced similar issues on multiple VLANs (IT managed of course!...) and they were mostly related to the DNS Server's functionality; apparently IP Addresses (especially DHCP established ones, however some static ones too!) are being "re-baptized" by the said DNS Server when transfered on a different "layer" and the "flushing/update" of the IP Address -> Name was not propely implemented.
Usually a skillfully placed call with the "flush the darn DNS queue" demand took care of it..until the next occurence of course...

do we can read the ARP from the ENBT card

Click to expand...

The method I would use to diagnose this is to install a network analyzer computer (usually running Wireshark) on a switch port that is "mirrored" to present the 1756-ENBT's traffic, and set the incoming packet filter to show only ARP traffic.

Yes Ken Roach,
I installed a PC with Wireshark software on one of the switch port.
but do you mean that I need to enable "Port Mirror" in the port that used for ENBT?
or on the port that used for PC?