Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to know ways of detecting rogue laptops connected to Ethernet sockets not properly secured in a big organization that has a plain network segment. I know that this can be prevented using some techniques like MAC filtering, but suppose that in this company they don't use any of these preventive security measures.

One possible solution I can think of is to use traceroute to identify the path and identify the last hop to the laptop. This can be used to identify the last router but...

Is it possible to use some layer-2 protocol or other techniques to identify where is a rogue laptop connected to an unprotected Ethernet socket in a big organization?

share|improve this question
up vote 9 down vote accepted

Any managed switch should be able to tell you which ports it has seen a given MAC address on. Identify the IP, ARP on that network, query switches on that segment for the given MAC address.

Prevention beats all, though: How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

share|improve this answer
Keep in mind that this technical solution will only work if you know what is supposed to be on your network in the first place. For that you need a complete inventory of all approved devices and their MAC addresses. Then you look at the MAC address tables on the switches to find those not approved. – GdD Mar 6 '13 at 9:06
This too is unpractical when organziation size goes to 26000 strong or more. You need a protocol or point solution approachi – Saladin Mar 6 '13 at 15:30

The technical answer or solution is what you call Network Admission Control. Its does all the police work for you.

On the suspicious switch you can run command not exact but something similar to show mac table. Basically all the port and mac binding is store at CAM table aka content addressable memory e.g

    Cat6K#show mac-address-table int gi 6/11

If you are thinking of actively blocking using in house switches then go for DAI aka dynamic arp inspection basically it is a white list for all arp requests and denies authorized mac to ip binding.

As for knowledge you should know at osi layer 3 and layer 2 there isn't any inherent control to stop spoofing from happening. It what you call unsolicated arp.Thus you have to rely on point solution for this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.