Network ops
DHCP & IP–MAC conflict report
Find IP conflicts, duplicate MACs, one MAC with many IPs and VLAN drift across DHCP leases, ARP and switch tables — then hand over a CSV or PDF report with the evidence attached.
Paste leases, ARP or MAC tablesFree up to 5 addresses
Mix any of dhcpd.leases, show ip dhcp binding, show ip arp, arp -a, ip neigh, show mac address-table, or a CSV with MAC, IP, hostname, site, VLAN and port columns.
How it works
- 01
Paste every source
Combine dhcpd.leases, show ip dhcp binding, show ip arp, arp -a, ip neigh, switch MAC tables or a CSV export. Mixed formats in one paste are fine.
- 02
Conflicts are grouped
Each site is checked for IPs held by several MACs, MACs recorded under several names, MACs with several IPs, and MACs seen in several VLANs or on several ports.
- 03
Hand over the report
Review each finding with its source rows, add the client name and notes, then export a CSV for remediation or a PDF to deliver.
What it is used for
MSP and IT service reports
Give clients a dated, branded-neutral PDF that lists every conflict with the evidence behind it, as part of a monthly health check.
Chasing intermittent outages
Duplicate IPs and flapping MACs cause drops that are hard to reproduce. The report points at the exact address and rows to check.
DHCP and IPAM clean-up
Find stale static assignments that collide with the DHCP scope, and reservations that drifted to the wrong VLAN.
Spotting cloned devices
One MAC under two hostnames usually means a cloned VM template, a copied NIC setting or a spoofed device.
Frequently asked questions
What counts as an IP conflict?
Two or more different MAC addresses recorded for the same IPv4 address within one site. In a single ARP snapshot that is a live conflict; across days of DHCP history it can also be a normal lease handed to a new device, so check the dates in the source rows.
Why is one MAC with many IPs only medium severity?
Routers, firewalls and proxy-ARP devices legitimately answer for many addresses, and multi-homed hosts hold several IPs. It is worth a look, but often expected.
What do VLAN and port drift mean?
The same MAC was learned in more than one VLAN or on more than one switch port. Moves and docking stations explain some cases; loops, misconfigured trunks and spoofing explain others. Uplink and trunk ports always show many MACs, so port drift is low severity.
How are private (randomized) addresses handled?
Findings that involve a locally administered address are marked, because a phone or laptop rotating its private Wi-Fi address can look like a conflict. Confirm those against DHCP and 802.1X logs before acting.
Is my data uploaded?
No. Parsing, detection and PDF generation run in your browser. When vendor lookup is on, only MAC addresses are sent to our lookup endpoint.
What do free and Pro include?
Free accounts check a limited number of rows per run (shown above the input) and see every finding. Pro checks up to 5,000 rows and exports the CSV and PDF report.