In which configuration mode is show ip dhcp conflict used?

The show ip dhcp conflict command is entered in Privileged EXEC mode on Cisco IOS devices.

DHCPPrivileged EXEC

show ip dhcp conflict

Displays IP address conflicts detected by the DHCP server, helping administrators identify and resolve duplicate IP assignments on the network.

Definition: show ip dhcp conflict is a Cisco IOS privileged exec command. Displays IP address conflicts detected by the DHCP server, helping administrators identify and resolve duplicate IP assignments on the network.

Overview

The 'show ip dhcp conflict' command is a critical diagnostic tool in Cisco IOS that displays any IP address conflicts detected by the DHCP server. When a DHCP server assigns an IP address, it typically pings the address before offering it to ensure it is not already in use. If the ping receives a reply, the server marks that address as conflicting and does not assign it.

This command shows all such conflicts, including the IP address, detection method (ping or gratuitous ARP), detection time, and the VRF (if any). Understanding this command is essential for network administrators to identify and resolve duplicate IP assignments, which can cause connectivity issues, routing problems, and security vulnerabilities. Conflicts often arise from static IP assignments overlapping with DHCP pools, misconfigured devices, or network changes.

The command is used during initial DHCP deployment, after network changes, or when users report IP address conflicts. Alternatives include 'debug ip dhcp server packet' for real-time monitoring or 'show ip dhcp binding' to see active leases. In the troubleshooting workflow, this command is typically run after noticing DHCP-related issues or when users cannot obtain IP addresses.

It helps isolate whether conflicts are causing the problem. The output is buffered and may require multiple executions to see all conflicts if the buffer is large. The command requires privileged EXEC mode (enable) and does not affect the running configuration.

Conflicts are stored in the DHCP server's conflict table, which can be cleared with 'clear ip dhcp conflict *' or individually. The command is available in IOS 12.0 and later, with minor output variations across versions. For large networks, conflicts can accumulate, so regular monitoring is recommended.

The command also supports VRF-aware DHCP, displaying conflicts per VRF. Overall, it is a straightforward yet powerful command for maintaining IP address integrity in DHCP environments.

Syntax·Privileged EXEC

show ip dhcp conflict

When to Use This Command

Troubleshooting duplicate IP address issues reported by users or network monitoring tools.
Verifying that a DHCP server has not assigned an IP already in use after a network change or outage.
Auditing DHCP scope health to ensure no conflicts exist before performing maintenance.
Investigating rogue DHCP servers or misconfigured static IPs that cause address conflicts.

Parameters

Parameter	Syntax	Required	Description
ip-address	A.B.C.D	Optional	Optional parameter to display conflicts for a specific IP address only. If omitted, all conflicts are shown. Common mistake: using an IP address that is not in the conflict table results in no output.
vrf	vrf vrf-name	Optional	Optional parameter to display conflicts for a specific VRF instance. Use 'show ip dhcp conflict vrf <name>' to filter by VRF. Common mistake: forgetting to specify VRF when using VRF-aware DHCP pools.

Command Examples

Viewing all DHCP conflicts

show ip dhcp conflict

IP address     Detection method  Detection time         VRF
192.168.1.33   Ping               Mar 01 2025 10:15 AM  default
192.168.1.45   Gratuitous ARP     Mar 01 2025 10:22 AM  default
10.0.0.12      Ping               Feb 28 2025 03:45 PM  default

Each row shows a conflicting IP address, how it was detected (Ping or Gratuitous ARP), the date and time of detection, and the VRF instance (usually 'default').

Clearing DHCP conflicts

clear ip dhcp conflict *

This command clears all recorded DHCP conflicts from the router's memory. No output is displayed upon success.

Understanding the Output

The 'show ip dhcp conflict' output lists every IP address that the DHCP server has detected as conflicting. The 'Detection method' column indicates how the conflict was discovered: 'Ping' means the server sent an ICMP echo request and received a reply, suggesting the IP is already in use; 'Gratuitous ARP' means the server received an ARP reply for the IP before offering it. The 'Detection time' shows when the conflict was logged.

The 'VRF' column indicates the Virtual Routing and Forwarding instance (typically 'default' for global routing). A healthy network should have no entries; any entry indicates a problem that needs investigation, such as a static IP overlapping with the DHCP pool or a rogue DHCP server.

Configuration Scenarios

Identify and Resolve a DHCP Conflict from a Static IP

A user reports they cannot obtain an IP address from the DHCP server. The network has a mix of static and dynamic IP assignments. The administrator suspects a conflict between a static IP and a DHCP pool.

Topology

DHCP_Server(S1)---192.168.1.0/24---Client_PC

Steps

1.Step 1: Enter privileged EXEC mode on the DHCP server: enable
2.Step 2: View all DHCP conflicts: show ip dhcp conflict
3.Step 3: Identify the conflicting IP address (e.g., 192.168.1.50) and note the detection method (e.g., Ping).
4.Step 4: Check the DHCP binding table to see if the address is leased: show ip dhcp binding
5.Step 5: Ping the conflicting IP from the server to verify it is in use: ping 192.168.1.50
6.Step 6: Determine the device using that IP (e.g., a printer with static IP).
7.Step 7: Change the static device to a different IP or update the DHCP pool to exclude that address.
8.Step 8: Clear the conflict from the DHCP server: clear ip dhcp conflict 192.168.1.50
9.Step 9: Verify the conflict is resolved: show ip dhcp conflict

Configuration

! Exclude the conflicting IP from the DHCP pool
ip dhcp excluded-address 192.168.1.50 192.168.1.50
! Alternatively, change the pool range
ip dhcp pool LAN
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8

Verify: show ip dhcp conflict - should show no conflicts or the cleared address no longer appears.

Watch out: Clearing a conflict does not prevent the same IP from being reassigned if the static device remains; you must exclude the IP from the pool or change the static device.

Troubleshoot DHCP Conflicts in a VRF Environment

A service provider uses VRF-lite to separate customer networks. DHCP pools are configured per VRF. A customer reports IP address conflicts. The administrator needs to check conflicts specific to that customer's VRF.

Topology

PE_Router---VRF_CUST_A---Customer_Switch---Client_PC

Steps

1.Step 1: Enter privileged EXEC mode: enable
2.Step 2: Display DHCP conflicts for VRF CUST_A: show ip dhcp conflict vrf CUST_A
3.Step 3: Note the conflicting IP address (e.g., 10.10.10.25) and detection method.
4.Step 4: Check the DHCP binding for that VRF: show ip dhcp binding vrf CUST_A
5.Step 5: Verify the IP is in use by pinging from the router with VRF context: ping vrf CUST_A 10.10.10.25
6.Step 6: Identify the device (e.g., a server with static IP).
7.Step 7: Coordinate with the customer to change the static IP or adjust the DHCP pool.
8.Step 8: Clear the conflict: clear ip dhcp conflict vrf CUST_A 10.10.10.25
9.Step 9: Verify: show ip dhcp conflict vrf CUST_A

Configuration

! Configure DHCP pool for VRF CUST_A
ip dhcp pool CUST_A_POOL
 vrf CUST_A
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8
! Exclude the conflicting address
ip dhcp excluded-address vrf CUST_A 10.10.10.25 10.10.10.25

Verify: show ip dhcp conflict vrf CUST_A - should show no conflicts.

Watch out: When using VRF, always specify the VRF in both show and clear commands; otherwise, the command operates on the global table and may not show the conflict.

Troubleshooting with This Command

When troubleshooting DHCP issues, the 'show ip dhcp conflict' command is a primary tool to identify duplicate IP assignments. Healthy output shows no conflicts or a small number that have been resolved. Problem indicators include a growing list of conflicts, conflicts for IPs that should be static, or conflicts that reappear after clearing.

Key fields to focus on: IP address (the conflicting address), Detection method (Ping or Gratuitous ARP), Detection time (when the conflict was detected), and VRF (if applicable). Common symptoms that this command helps diagnose include: clients failing to obtain an IP address (DHCPNAK), intermittent connectivity, duplicate IP warnings in system logs, or users reporting 'IP address conflict' messages. A step-by-step diagnostic flow: 1) Run 'show ip dhcp conflict' to see all conflicts. 2) If conflicts exist, note the IP addresses. 3) Check the DHCP binding table ('show ip dhcp binding') to see if the address is currently leased. 4) Ping the conflicting IP from the router to see if it responds. 5) If it responds, identify the device (e.g., using 'show arp' or checking the MAC address). 6) Determine if the device uses a static IP or if it is another DHCP client. 7) If static, either change the static IP or exclude the address from the DHCP pool. 8) If another DHCP client, check for rogue DHCP servers or misconfigured relays. 9) Clear the conflict using 'clear ip dhcp conflict *' or individually. 10) Monitor to ensure the conflict does not reappear.

Correlate with other commands: 'show ip dhcp server statistics' to see overall server health, 'debug ip dhcp server packet' to see real-time DHCP exchanges, and 'show ip arp' to see MAC-to-IP mappings. For persistent conflicts, consider using 'ip dhcp conflict logging' to log conflicts to syslog. In large networks, conflicts may indicate a rogue DHCP server; use 'show ip dhcp server statistics' to see if offers are being sent from unexpected sources.

Remember that the conflict table is stored in RAM and is cleared on reload unless saved to NVRAM (not typical). Regularly clearing the table and addressing root causes is best practice. The command is also useful after network changes, such as adding new static devices or changing subnet masks.

If conflicts appear for IPs outside the DHCP pool range, check for overlapping subnets or misconfigured relays. In summary, 'show ip dhcp conflict' is a straightforward yet powerful command that should be part of every network engineer's DHCP troubleshooting toolkit.

CCNA Exam Tips

CCNA exam may ask which command displays DHCP conflicts; remember 'show ip dhcp conflict'.

Know that conflicts can be detected via Ping or Gratuitous ARP; the exam might test these detection methods.

Understand that clearing conflicts does not resolve the underlying issue; it only removes the log entry.

Be aware that the 'clear ip dhcp conflict *' command clears all conflicts; the asterisk is required.

Common Mistakes

Mistake: Forgetting to clear conflicts after resolving the duplicate IP; the conflict entry remains until cleared.

Mistake: Assuming 'show ip dhcp conflict' shows all DHCP issues; it only shows conflicts, not other problems like scope exhaustion.

Mistake: Using 'clear ip dhcp conflict' without the asterisk; the command requires an IP address or '*' to clear all.

show ip dhcp conflict vs show ip dhcp binding

Both commands are used to troubleshoot DHCP address allocation, but they serve different purposes. 'show ip dhcp conflict' reveals IP addresses with duplicate assignments detected by the server, while 'show ip dhcp binding' lists all currently leased IP addresses. Network administrators often confuse them because both relate to IP address usage.

Aspect	show ip dhcp conflict	show ip dhcp binding
Information Provided	Conflicting IP addresses and MAC addresses	Leased IP addresses, MAC, lease expiration, binding type
Data Source	DHCP server conflict detection logs	DHCP binding table (active leases)
Trigger	Occurs when a ping or ARP detects duplicate IP on network	Occurs when a client receives a lease from the server
Storage	Volatile memory (cleared on reboot)	Volatile memory unless persistent DHCP configured
Typical Use	Identifying IP address conflicts on the network	Viewing active DHCP leases for troubleshooting or inventory

Use show ip dhcp conflict when you need to find and resolve duplicate IP addresses that may cause connectivity issues.

Use show ip dhcp binding when you want to verify which devices have obtained IP addresses and their lease status.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax and output are identical to classic IOS. However, on some IOS-XE platforms, the output may include additional fields like 'Interface' or 'VLAN' if the DHCP server is configured with interface-based pools. The NX-OS equivalent command is 'show ip dhcp conflict' as well, but NX-OS uses a different DHCP server implementation (feature dhcp).

The output format is similar but may include 'VRF' column by default. On ASA firewalls, DHCP server functionality is limited; the command 'show dhcpd conflicts' is used instead, with similar purpose but different syntax. For IOS-XR, the DHCP server is typically not used; instead, DHCP relay is common.

The command 'show dhcp ipv4 conflict' exists in some IOS-XR versions but is not standard. Between IOS versions, the output format has remained consistent from 12.x to 15.x and 16.x. In older IOS (12.x), the 'VRF' column may not appear if VRF-aware DHCP is not configured.

In 15.x and later, VRF support is standard. The command is available in all IOS versions that support DHCP server (starting from 12.0). There are no significant behavioral differences across versions.

For Catalyst switches running IOS, the command works the same as on routers. On some platforms, the conflict table size is limited (e.g., 1000 entries); if exceeded, new conflicts are not logged. Use 'show ip dhcp conflict statistics' (if available) to see table utilization.

Always refer to the specific platform documentation for any nuances.

Related Commands

show ip dhcp binding

Displays the current DHCP binding table, showing which IP addresses have been leased to clients, along with their MAC addresses, lease expiration, and type of binding.

show ip dhcp server statistics

Displays DHCP server statistics, including the number of messages sent and received, to monitor DHCP server performance and troubleshoot issues.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions