MAC Address Monitoring

howler · 24 Jul 2009 at 11:25

Is there any software out there that will keep a database of all the MAC addresses currently on my network and then send me an email alert if one pops up that has not been seen before?

Witor · 24 Jul 2009 at 12:34

(keeps an eye on this thread)

RabbiJacob · 26 Jul 2009 at 09:59

Sounds like you want to identify rogue machines on your network? or lock it down?

I manage this from another angle, IP addresses are only given to machines whose mac addresses are in an approved list. We use InfoBlox for this, which isn't cheap. But it can be achieved with standard DHCP by assigning a specific IP address to a mac address.

Don't know if that helps

garyh · 26 Jul 2009 at 10:10

Theres a UNIX tool which does this very well:

http://freequaos.host.sk/arpwatch/

m4cc45 · 26 Jul 2009 at 13:59

Also look into NAC - Sophos do one as do many companies and if you have Sophos AV you normally get basic NAC free.

M.

howler · 27 Jul 2009 at 11:44

I need to see if someone plugs in an unrecognised machine, I don't really want to spend loads of money on a tool to do as it is pretty unlikely to happen in our small office but it is something we need to be aware of

We don't use Sophos AV so no NAC

Does 2008 server have NAC built in?

RabbiJacob · 27 Jul 2009 at 12:31

I believe there are some open source NAC solutions, not sure how good they are though.

Server 2008 has Network Access Protection (NAP)

#Chri5# · 27 Jul 2009 at 13:55

You could probably come up with something if your switches support 802.1X

howler · 27 Jul 2009 at 14:07

not got 802.1x switches sadly

the_jetsetwilly · 27 Jul 2009 at 16:11

theres a mac trackmodule in Cacti that we use. it periodically queries the network switches via snmp and keep a database of what port they are on etc and also you can do alerting for specific Macs

if needed i reakon we could get it to trigger an action to connect to the relevent switch port and shut it down if needed.

we mainly use it to track down rouge dhcp servers that average 1 per year.

howler · 28 Jul 2009 at 12:22

If I was to buy a single switch capable of doing 802.1x and plug my DHCP server into that would I be able to only assign IP address' to the devices I permit?

RabbiJacob · 28 Jul 2009 at 12:46

As I said earlier, you could do this purely from DHCP by assigning static IP addresses to your machines and setup exclusions. If you have a small number of machines this is quiet manageable - I have 600ish I manage this way. But it depends how secure you want to be, for me this is enough, our students are barely computer literate

An attacker would have to steal an IP address from a machine and set it statically or spoof a MAC to get access to the network.

You could also setup something like Cacti monitoring MAC addresses as an extra precaution

Curiosityx · 30 Jul 2009 at 23:38

Have you considered DHCP Snooping? That is if your switches support it?

http://en.wikipedia.org/wiki/DHCP_snooping