I want to have a setup in which once i configure a single MAC address for a network jack only that computer may be connected to it. Also, i want to make sure that there is no way a person may get a router's mac address registered and hook up multiple PCs behind the router in a NAT or atleast it should be discoverable.

I know this is somehow possible, as this was done at my university. Anyone knows how?

  • 1
    What kind of switches do you have?
    – Zoredache
    Commented Nov 25, 2009 at 22:56

5 Answers 5


You'll want to use Cisco Port Security on the access-layer switch. It allows you to set the maximum number of MAC addresses on a certain port, as well as optionally set the specific allowed MAC addresses on that port (Though managing this can get out of hand). Once more MAC addresses are detected, or a different MAC address is swapped in, the port can be configured to shut itself down.

I'm not sure how to stop people from hooking up a NAT-capable router, as in this case, only one MAC address is exposed to the access-layer switch. Port security won't be able to help (Unless you rely on the fact that swapping out a workstation for the router will cause a MAC address change, blocking the port, but this isn't perfect as if the first device to be plugged into the switch is the router, it becomes the allowed MAC address)

More info at https://web.archive.org/web/1/http://articles.techrepublic%2ecom%2ecom/5100-10878_11-6123047.html

  • 1
    Not to mention that you can "clone" the MAC address of the workstation onto the dinky-toy router.
    – womble
    Commented Nov 26, 2009 at 13:58

It cannot be done.

I take a machine with a registered MAC, and replace it with a NAT router that I tell to use the registered machines MAC. Plenty of consumer grade (well under $100) routers can do this be default.

Short of analyzing TCP sequence numbers, it is not possible to know if someone has done this.

But any managed switch should be able to lock ports to MAC addresses (ok, I'm guessing).

  • I don't think it is accurate to say it cannot be done. You can make it very difficult, and then combine that with good logging. If you have lots of money you would use 802.1x and/or require software agents on the machine instead of simply allowing based on the hardware address. Your consumer grade router most likely will not support the encryption or software agents necessary to authenticate
    – Zoredache
    Commented Nov 26, 2009 at 4:02
  • 4
    You are not paranoid enough. But running all the clients thought a vpn is the way to lock out the untrusted. My point was that you cannot secure your network based on MAC addresses, as those are easily spoofed. Commented Nov 26, 2009 at 4:48
  • If you really want to be paranoid and prevent connecting of untrusted computers, forget playing with MAC addresses. VPN, certificates, encryption, digital signatures, etc. are the way to go. Other solutions are only avoiding it instead doing it right.
    – slovon
    Commented Nov 26, 2009 at 10:17
  • What's to stop someone running the VPN or whatever on their dinky-toy router?
    – womble
    Commented Nov 26, 2009 at 13:59

You need a switch that is smart enough to configure this limitation. There are plenty of them, but not in the cheapest class.


There are several switches much under cisco-prices available with port security options. I found HP Procurve 2520 and higher, Dell Powerconnect 5300 and higher and even cheaper, such as Linksys SRW2024, D-Link DES-3252, etc.

Look for "port security", "MAC based".

  • 1
    They are, in fact, often ludicrasly expensive Commented Nov 25, 2009 at 23:23
  • Those shiny Cisco name-plates are filled with gold, which is at an all-time high price right now. Commented Nov 25, 2009 at 23:31
  • tell me about it... just finished picking a 48-port switch for an office... took the little cisco :-)
    – slovon
    Commented Nov 25, 2009 at 23:56
  • Cisco paints their stuff green for a reason..
    – GregD
    Commented Nov 26, 2009 at 0:21

Alternatively, you can use a NAC if the users are in an LDAP of some sort. This way users can move from port to port, but people outside of your organization can't get access. I'm not sure if this is the situation that you are trying to prevent, but MAC address spoofing is easy, so your example can be tampered with fairly easily. Cisco Clean Access and Bradford Networks NAC come to mind as the two leaders in NACs, but they are veeery expensive.


I might be wrong, but I've heard of ISPs monitoring TTL values to determine if the device directly attached originated the traffic or if it came from devices behind it.

Not perfect, as TTL can be spoofed just like anything else but may be worth checking out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .