New answers tagged ip-spoofing
What is one of the best ways to determine whether or not a user is abusing IPs? There's no good way, and it probably shouldn't be your goal. The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead. As we've been tracking ...
So the thing here is to go spelunking around the switches to isolate the location of the source. You could figure out a window period where this is happening and focus your efforts there. If it's in a regular interval, then that's a great thing. Anything else, is a pain.
I blocked the offending MAC address, and in the past year never got a complaint from a user, so that seems to be the fix.
Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security. An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), ...
Top 50 recent answers are included