How to block a MAC address in the DHCP?

hi,

I have a DHCP server and some unknown users are connected to it. I want to block them through MAC address is there any way? or is there any way to block a particular MAC address on my network?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

dynamik

You could probably just create reservations and assign them bogus info (you might need to create a new scope to do this).

Ahriakin

Before you block them I'd trace the MAC through your network and try and find the source (run through the MAC address table/port mapping on your switches). Maybe also port-scan and then capture some traffic from it, check your logs etc. Your IP settings are trivial to guess once the attacker has access to a working machine, they just need to copy some details from a valid client and guess at free addresses. Usually this kind of thing is an employee bringing in their own laptops to leech internet bandwidth. More important than just blocking one MAC is stopping the practice before it spreads by making an example....
Otherwise yup as Dynamik said associate to a blocked IP

mark_s0

We use dynamik's method of blocking users but our other site uses some software called DHCP Turbo which can stop a given mac address from receiving an IP address from the DHCP server.

JBrown

There is a tool for that

)
DHCP Server Callout DLL for MAC Address based filtering - Microsoft Windows DHCP Team Blog - Site Home - TechNet Blogs and if i remember correctly it works for 32bit only.

gandalph

JBrown wrote: »

There is a tool for that )
DHCP Server Callout DLL for MAC Address based filtering - Microsoft Windows DHCP Team Blog - Site Home - TechNet Blogs and if i remember correctly it works for 32bit only.

the site says it works with 2008 R2 which is 64 bit.

cahmadh

I have installed the CALLOUTDLL but in the usage they are asking to play around with the registry keys a little bit.
Is it safe for my DHCP server?

JBrown

It all depends on how familiar you are with registry. One thing for sure, make a backup of it before messing around.

wild_kick

cahmadh wrote: »

hi,

I have a DHCP server and some unknown users are connected to it. I want to block them through MAC address is there any way? or is there any way to block a particular MAC address on my network?

I found this article that has a video on how to do just that. It works on a WIndows 2003 Server.
Block Mac Address
DHCP Block List - Callout DLL - Tech and Web Guy