Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Blocking a Single MAC Address

Mike Block
Occasional Visitor

Blocking a Single MAC Address

I have an unauthorized user with a laptop that got around our authorized DHCP by assigned themselves a valid static IP, subnet mask, and gateway. I have disabled their port on the Procurve 4000M, but with a mobile workstation, they can just go to another live connection.

Is there any way to stop this from happening on the switch level without having to use BOOTP? I have found references to doing so on a "non-trunked" connection, but of course I am using trunking. If so, is there a way to block this spanning my entire network, all 4000Ms and 4108Gs (without monkeying with the troublesome Cisco router)?

Thanks in advance,
Mike
3 REPLIES
Mohamed Hamedi
Respected Contributor

Re: Blocking a Single MAC Address

Have you considered using 802.1x for your authentication?
Mohamed Hamedi
Respected Contributor

Re: Blocking a Single MAC Address

Here is a link to some documents on security that you might be able to implement http://www.hp.com/rnd/focus/security/index.htm
Lee Hundley
Valued Contributor

Re: Blocking a Single MAC Address

Not sure about blocking at the switch level, but one solution I've used in the past is running ettercap's "leech" plugin. Assuming you know the IP address of the offender its quite simple.

ettercap -Np leech

I had this issue on my 802.11b network (damn neighbors) and ran a script via cron that would grep the MAC address I was looking for, and then run ettercap against it's IP. Given the size of your network, ARP poisoning may not be the most efficient means of blocking, but definately effective.

http://ettercap.sourceforge.net
It is my firm belief that it is a mistake to hold any firm beliefs