Kernaali ToolsA duplicate-IP warning is a reason to identify address ownership, not to reset every device. Determine whether two devices are answering for one address or whether a second DHCP server is distributing conflicting leases. Those causes need different corrections.
Applies to: UniFi Network application, IPv4 DHCP networks and supported UniFi switches. DHCP Guarding in the current guide requires UniFi switches; do not assume an unmanaged or third-party switch enforces it. IPv6 duplicate-address detection is outside this workflow.
Validation: documentation-checked on . No device or lab test is claimed. Version references identify the documentation checked, not a firmware upgrade recommendation.
Confirm the conflict on the affected VLAN
Record the alert time and affected network, then compare the intended DHCP lease/reservation with any manually configured host using the same address. Use the approved management views or a short authorized ARP/DHCP capture to see whether the address actually maps to more than one device. Keep hardware identifiers in private notes.
Synthetic example: a printer is manually set to 192.0.2.50 while the DHCP pool includes 192.0.2.20–192.0.2.200. A different client can receive .50 unless the allocation plan excludes or reserves it appropriately. The official duplicate-IP guide identifies manually assigned addresses inside a pool as one conflict source. An old client-list entry alone does not establish a simultaneous conflict.
Distinguish duplicate ownership from competing DHCP offers
| Evidence | Smallest next action |
|---|---|
| Two active devices answer for one IPv4 address | Correct the manually assigned address or intended reservation/allocation |
| A test client sees offers from an unexpected server | Locate that server’s physical/network path and verify whether it is authorized |
| Only one current owner; warning followed a device move | Correlate the event time and current state before changing addressing |
| Many clients receive the wrong gateway or DNS | Inspect the actual DHCP offers and server identity, not only the Network client list |
On one test client, compare the received address, subnet, gateway and DNS with the intended server settings. A second server can exist behind an accidentally connected router even when the UniFi gateway’s own pool looks correct. Do not disconnect an uplink until you know which devices depend on it.
Apply addressing or guarding at the correct boundary
For a static-address conflict, select an unused address from the documented static range or change the allocation plan so that two owners cannot receive it. Update dependent service records and test only the affected client first. Do not delete all leases: that does not remove a manually configured duplicate.
For an unauthorized DHCP server, remove its unintended service or isolate its verified access port. DHCP Guarding can then permit the legitimate DHCP server on supported UniFi switches. Enter the real server address; use the gateway’s address only when the gateway is the DHCP server. Check relay and third-party server designs before enabling the guard. A wrong trusted-server value can prevent new leases across the network.
Record the original guard state and trusted address, retain a management path that does not depend on a new lease, and apply the change to the intended network. VLAN membership must also be correct; the VLAN diagnostic path helps distinguish failed transport from a guarded offer.
Verify new leases, then restore if necessary
Renew an authorized test client and confirm it receives a single intended offer, a unique address and the correct gateway/DNS. Open an actual service and watch for a repeated conflict during a subsequent lease cycle. Existing online clients with cached leases are not sufficient evidence that guarding works.
If legitimate leases stop after enabling the guard, restore the recorded guard settings and investigate the trusted-server path. If an address change broke a service, restore its previous address only after ensuring no other host currently owns it; otherwise choose a verified unused address. Preserve a short private record, not a public client inventory.
Technical references
Found an issue? Send a correction with a reproducible example.