Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use portsentry to block ip address who trying to scanning. Now how do I want to block mac address who trying to scanning. Can I use portsentry, or possibly other tools?

share|improve this question

The mac-address changes at every hop, so the only way to block this would be to the do an ARP request. With this you risk that the attacker intentionally starts sending the mac addresses of other, legitimate computers on the network and you risk to DoS yourself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.