Cannot find IPAM IP conflict

tersteew

I have an alert that keeps coming up about an IP conflict in IPAM.  It shows two MAC addresses one discovered with DHCP (Dynamic) and it is valid and online (I can see it on the switch).  The other MAC is supposedly coming from Subnet SNMP scan.  I have searched every switch and even UDT and cannot find this ghost MAC anywhere.  I am wondering if it is stale SNMP data sitting on some switch but I don't know how to find where the system is getting this info from the scan.  Are there logs anywhere or and database tables that will tell what device it thinks the MAC is actually coming from?

coda6

I have a similar issue. I keep getting this alert:

"NetPerfMon Event Log : The IP address 172.XX.XX.X is in conflict.

The following devices were detected on network with same IP address:

- PingSweep vs DHCP data MAC: 00-00-01-XX-XX-XX, MAC: 10-F3-11-XX-XX-XX ,

- PingSweep vs DHCP data MAC: 10-F3-11-XX-XX-XX, MAC: 00-00-01-XX-XX-XX" action was executed successfully

What concerns me is that it says it is comparing DHCP data. When I look at the leases in IPAM for the scope it shows a lease for the IP and it also shows that the lease expired 6 months ago.

So I log into the DHCP server, it does not show that lease, which I would assume it wouldn't as it's in an excluded address range.

I then rescanned the DHCP server from IPAM, but it didn't remove the stale lease.

Is there a way to query the IPAM database and remove it manually? What about flushing any cached DHCP info and then rescanning the DHCP servers?

Thanks for the help.