From owner-freebsd-questions@FreeBSD.ORG Mon Sep 27 05:36:17 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 540FB16A4CE for ; Mon, 27 Sep 2004 05:36:17 +0000 (GMT) Received: from mail18.syd.optusnet.com.au (mail18.syd.optusnet.com.au [211.29.132.199]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8E51543D31 for ; Mon, 27 Sep 2004 05:36:16 +0000 (GMT) (envelope-from russm-freebsd-questions@slofith.org) Received: from [127.0.0.1] (c211-28-91-36.smelb1.vic.optusnet.com.au [211.28.91.36])i8R5aEOS006431; Mon, 27 Sep 2004 15:36:14 +1000 In-Reply-To: <4157A263.7060307@optonline.net> References: <20040927085147.7b2d8575@bofh.spyderweb.com.au> <4157A263.7060307@optonline.net> Mime-Version: 1.0 (Apple Message framework v619) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <253578F8-1047-11D9-83E5-000A95DA456C@slofith.org> Content-Transfer-Encoding: 7bit From: russell Date: Mon, 27 Sep 2004 15:36:13 +1000 To: bsdfsse X-Mailer: Apple Mail (2.619) cc: "freebsd-questions@FreeBSD.ORG" Subject: Re: IP address conflicts X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Sep 2004 05:36:17 -0000 or use a tool like arpwatch that is specifically designed to let you know when MAC/IP relationships change on your network. you log the MAC addresses of all the fixed workstations in the school, then when one of them starts doing the wrong thing you know *exactly* where to go to nab the culprit. If it's not one of the fixed workstations then you've got a bit more work to find the kiddie, but it's nothing insurmountable. On 27/09/2004, at 3:17 PM, bsdfsse wrote: > Hi, > > Could you run a packet sniffer (like Etheral), and log the traffic for > the specific IP's in question? You would see when the MAC address > changed for a given IP. > > Once you knew their MAC address, you could log all their traffic. > Maybe block their traffic. Ban them from your network. > > thx! > > > Tim Aslat wrote: >> Hi All, >> I have an annoying situation in a school I do casual work in their IT >> department. There are a number of individuals within the system who >> think it's funny to allocate an IP address on a workstation identical >> to >> the network's proxy/web/mail servers. What I'd like to know is, would >> there be any way of preventing this short of spending quite a lot of >> money on managed switches an the like? >> I'm unable to restrict access to settings on the machines, as they are >> notebooks owned by the students/staff and could be legitimately >> plugged >> in anywhere in the network. >> Unfortunately solitary confinement on bread & water, or public >> floggings aren't an option. >> Any suggestions? >> Cheers >> Tim > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" >