Blocking a Single MAC Address

[Mike Block]

I have an unauthorized user with a laptop that got around our authorized DHCP by assigned themselves a valid static IP, subnet mask, and gateway. I have disabled their port on the Procurve 4000M, but with a mobile workstation, they can just go to another live connection.

Is there any way to stop this from happening on the switch level without having to use BOOTP? I have found references to doing so on a "non-trunked" connection, but of course I am using trunking. If so, is there a way to block this spanning my entire network, all 4000Ms and 4108Gs (without monkeying with the troublesome Cisco router)?

Thanks in advance,
Mike

[Mohamed Hamedi]

Have you considered using 802.1x for your authentication?

[Mohamed Hamedi]

Here is a link to some documents on security that you might be able to implement http://www.hp.com/rnd/focus/security/index.htm

[Lee Hundley]

Not sure about blocking at the switch level, but one solution I've used in the past is running ettercap's "leech" plugin. Assuming you know the IP address of the offender its quite simple.

ettercap -Np leech

I had this issue on my 802.11b network (damn neighbors) and ran a script via cron that would grep the MAC address I was looking for, and then run ettercap against it's IP. Given the size of your network, ARP poisoning may not be the most efficient means of blocking, but definately effective.

http://ettercap.sourceforge.net