Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given a network structure like this:

client 1 \
.         \
.          switch -- firewall
.         / 
client n /

(in words: all clients connected to one switch and the switch connected to the firewall)

Is it possible (on the firewall) to identify the physical port on the switch that a client used?

Background: There's some simple MAC authentification for the clients, there can only be 1 person responsible for what happens an a switch port (because there is just one RJ45 connector per room and 1 person who owns the room). However, it would be possible to fake the MAC address, then I wouldn't know from which room the data is coming, however I need to know this for sure in case of abuses. Is this possible without vlans? Thanks for any hint!

share|improve this question
up vote 2 down vote accepted

You can know this by implementing port security on your switch. One requirement is that you have a managed switch. Only one MAC address will be allowed on each switch port.

share|improve this answer
Thank you, that's perfect and also supported on the HP switch I am using (up to 8 MAC addresses per port) – Jun 3 '12 at 14:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.