Our network administrators forbid the usage of private routers in our college. They bought new Cisco equipment (routers, switches) which detect routers and automatically ban them (it disconnects the room from switch port).

I'm a bit in touch with them and they said it does not work if the student plugs in switch first and routers after that (topology port->switch->router->pc). With this information I'm assuming these Cisco devices do not detect routers based on TTL as I originally thought. These administrators does not know how it works either, when I asked them how it detects they answered "It's Cisco"...

  • Is the ban immediate, or take some time? Does it auto-revert once you remove the router?
    – lew
    Jul 11, 2011 at 0:37

2 Answers 2


It depends on what routing technology that you use.

I know cisco switches have a optional security setting on allowing only a few MAC addresses associated with a port. See port-security.

This makes it impossible to set up a bridge between your network and your colleague's network, as the bridge will proxy the arp packets between the two networks, hence making the switch block the port.

A gateway router between two networks will not work either, because they will have to manually add your gateway/network in their router's routing table.

But, a NAT gateway should work, but along with the limitations a NAT router have. The colleague's network will not be able determine if your machine is acting as a gateway for your subnet or is acting as a single machine. (Unless cisco have implemented some crazy fingerprinting to determine inconsistency between the TCP/IP stacks used for various connections).

So, with these three possibilities, I suspect it is the port security which is banning routers from connecting to your network.

  • of course it detects nat, thats whole point why am i asking
    – gadelat
    Jul 10, 2011 at 13:35
  • interesting, I've not seen any products capable of detecting and blocking NAT-routers. Do you know what kind of cisco equipment they have acquired? Jul 10, 2011 at 13:42
  • 1
    Nope, but you can read more about possible ways in magazine hakin9 3/2005 . But it's 6 years old and not supposed for integration in routers, i was curious how cisco devices do that.
    – gadelat
    Jul 10, 2011 at 13:56
  • If you find out what equipment the use, I'm sure you will find the options described in some manuals. Jul 10, 2011 at 14:08
  • Very nice article, but it all seems like a cat and mouse game. I wonder how the cisco equipment will react to a client running virtual PC's with the host machine running as a NAT router. Jul 10, 2011 at 14:19

Network engineer here.

By default most Cisco devices advertise Cisco Discovery Protocol (CDP) information. That’s a layer-2 multicast advertisement. Seeing what Cisco devices are connected to a Cisco device with an Ethernet cable is as simple as typing in “show cdp neighbors”.

Many network devices also advertise LLDP (link layer discovery protocol) information, an industry standard protocol similar to CDP.

Both these protocols can be turned off “no CDP run” but plugging network equipment together can cause outages: as a network administrator I ask you not to turn off the information we need to combat outages.

It’s also possible to detect switches because they talk the spanning tree protocol (bpdu-guard/port security feature can detect spanning tree and disable the port automatically). Even Mac addresses are assigned to different vendors and (sometimes) can be looked up to identify a probable network device. I remember one old deployment where access points were automatically blocked by Mac-address. But that’s no longer effective given the number of AP vendors now.

Another technique is to block ports based on the number of Mac addresses seen on the port.

When ports are automatically blocked they go into “errordisable” state. By default they do not recover until the next network device reboot (rare) but common practice is to enable “errordisable timeout” to a few hours to “discourage” the behavior without expending man-hours manually reenabling ports.

Another technique is to not offer dhcp leases to particular types of requests. I remember a dhcp setup where windows machines would not get dhcp leases. But I don’t have details how that was implemented.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .