[CLUE-Tech] Finding rogue IPs.

[David Anselmi]

Suppose you have a network in your two story office building with around 
250 network drops (10/100BT hubs).  Suppose one of your servers becomes 
unreachable and you find that arp gives you a different MAC address than 
you expect.

Seems like someone has plugged in a machine and given it the same IP as 
your server, and somehow this rogue machine wins the arp battle.  So 
your IP has been stolen.

Anyone seen this before?

How would you find the rogue machine to fix the problem?

Dave