How to track down a rogue laptop connected to an un protected ethernet socket in a big organization?

Question

I would like to know ways of detecting rogues laptops connected to ethernet sockets not properly secured in a big organization that has a plain network segment. I know that this can be prevented using some techniques like MAC filtering but suppose that in this company they don't use any of this prevention security measures.

One possible solution I can think is to use traceroute to identify the path and identify the last hope to the laptop. This can be used to identify the last router but...

Is it possible to use some layer-2 protocol or other techniques to identify where is a rogue laptop connected to an un protected ethernet socket in a big organization?

Answer 1

Any managed switch should be able to tell you which ports it has seen a given MAC address on. Identify the IP, ARP on that network, query switches on that segment for the given MAC address.

Prevention beats all, though: How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

Answer 2

The technical answer or solution is what you call Network Admission Control. Its does all the police work for you.

On the suspicious switch you can run command not exact but something similar to show mac table. Basically all the port and mac binding is store at CAM table aka content addressable memory e.g

    Cat6K#show mac-address-table int gi 6/11

If you are thinking of actively blocking using in house switches then go for DAI aka dynamic arp inspection basically it is a white list for all arp requests and denies authorized mac to ip binding.

As for knowledge you should know at osi layer 3 and layer 2 there isn't any inherent control to stop spoofing from happening. It what you call unsolicated arp.Thus you have to rely on point solution for this.