Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if there was a way, that whenever a hostile device (unknown device, like a wireless router a personel member brings to the office) this would be notified to a central system with the switch on which it occured and what port.

I know you can shut down ports with port security, but is there a way there would also be an immediate notification ?

share|improve this question
up vote 3 down vote accepted

A network intrusion detection device should be able to do this for you.

A simple one-off utility is arpwatch, which will alert you to any changes (including additions) in MAC to IP address mappings.

share|improve this answer

802.1x can provide both port security (only allowing authorized computers) and can report unauthorized connections. You should be able to leave it in "test" mode (most implementations call it that when they allow traffic regardless of successful/failed authentication) and simply monitor the logs/reports.

share|improve this answer

Probably over thinking this on my part, but you could write a script scan the network with the nmap tool to scan the entire network, log new entries, and block them.

share|improve this answer

The big question is: What is a "hostile" device? There are a lot of different strategies to implement this:

  • You can configure some switches to send SNMP traps when an unknown MAC address has been connected.
  • You can configure your switch to only be open for DHCP until the DHCP server gives a DHCPACK (the exact term of this technology escapes me). You can then control access on the level of the DHCP server (i.e. linking to an Asset Management system to see whether the MAC address is known to the company).
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.