[Jeff Parker <jparker@xxxxxxxxxxxx>]

> If it's not yours, run Ethereal, clear your ARP cache, and 
> then ping the address.  Before you ping, your machine will 
> ARP.  Check for duplicate ARP replies.

Excellent advice if you know the address that has been
compromised.  The question of detecting that someone
might be using some (unknown) IP address is an interesting
one.

I would gladly put up with an application that has some
false positives when you change you NIC card if it

	1) Caught all duplicates used within a configurable
	   window (this should allow you to reuse via DHCP)
	2) Only told me once about each event

This isn't rocket science, but would make a nice application.
Perhaps one of the academics running a networking class
could use this as an assignment and post the best solution?

- jeff parker
- axiowave networks