I maintain a small LAN ( on which we have several untrusted machines, where the users of those machines have administrative rights or are able to connect their own machines to the network.

The server is also on that network ( and I need to prevent an IP conflict from taking down network services when the user sets his machine's IP the same as the server (possibly maliciously).

I've though about breaking the netowrk into two (something like and

What's the best way to keep services up?

  • 7
    You take away the user's admin/root privileges to set a static IP. Barring that, you explain to the all of 15 people in your office not to set a static IP to If they do it at that point, it's a disciplinary issue. This isn't that hard. – TheCleaner Dec 19 '13 at 21:15
  • TheCleaner: any person with a mobile can set static IP address of its smartphone. – Pol Hallen Dec 19 '13 at 21:17
  • Only if you allow them to connect to WiFi. Don't do that, either. If this happens frequently, try communicating with the users. Most places have a AUP (Acceptable Use Policy) that explains what they are, and are not, allowed to do with devices on the network. – mfinni Dec 19 '13 at 21:29
  • 1
    @PolHallen - then you give them a metaphorical smackdown every time they do it – Mark Henderson Dec 19 '13 at 21:30

Move your servers to a separate VLAN - this will mitigate although there is nothing preventing the user from setting his IP to that of the gateway. Or better, move the problem user to his own VLAN.

This can also be solved by using dynamic arp inspection on a good enough managed switch.

This can also be solved by treating it as a disciplinary problem that needs to be addressed at that layer.

Failing that, a Nailbat may be the last resort.

| improve this answer | |

The technical solution to this sort of problem is 802.1x, but that's probably overkill for this situation.

Make your users trust DHCP and/or don't allow them to modify their IP settings.

| improve this answer | |

If he knows the IP, and has rights to change the IP address of a machine, there is not much you can do. You could look at playing around with IP Source guard with DHCP Snooping to force the user to use DHCP.

| improve this answer | |
  • Maybe I can work on static arp tables? – Pol Hallen Dec 19 '13 at 21:20
  • 3
    No, don't do that. – mfinni Dec 19 '13 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.