Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

Yesterday a laptop crashed the network because the IP address of the computer was the same as the router. Computers in the network were reaching the laptop instead of the router.

Is there anyway to prevent this from happening?

We currently have a D-Link DFL860.

share|improve this question
    
First, add dhcp to the subnet if you have not already done so; ensure that laptop addresses are managed by dhcp. Next you need something which performs ARP inspection. Cisco IOS and Junos have this feature; I cannot find it in the DFL860 (but I am searching from my phone). –  Mike Pennington May 14 at 13:20
    
Thanks Mike. If I understand you, when a computer set his static IP, it will send a ARP to the router. Then the router can detect and take action to block that computer? –  Patrick Dubois May 14 at 13:30
4  
Close, more precisely you need the switch that the laptop plugs into to have ARP inspection. This feature is a little painful to maintain. Most people simply accept the risk of a duplicate address and educate users not to do this kind of thing. It all depends on the environment. Technically what you want is possible. In a high - security environment, use ARP inspection to prevent this and other ARP spoofing attacks. –  Mike Pennington May 14 at 13:34
    
I don't have a managed switch and we are quite a small company. I think education will be the best solution so far. –  Patrick Dubois May 14 at 13:45

2 Answers 2

On a normal Ethernet there is nothing that can prevent devices on the network to interfere with each other. Tools like DHCP can assist in preventing accidental conflicts if used correctly, but malicious or misconfigured hosts can still cause problems.

Some things that are common:

  • Conflicting addresses (two or more MAC addresses that claim to have the same IP address in ARP or ND)
  • ARP or ND spoofing (someone intentionally pretending to be someone else)
  • Rogue RAs (someone sending IPv6 Router Advertisements when they shouldn't)
  • Rogue DHCPv4 or DHCPv6 servers (DHCP servers that shouldn't be there)

As ethernet is a broadcast medium everybody can broadcast anything they want, unless special actions are taken. For such special actions you need equipment that can implement them. This means you need enterprise-grade ethernet switches, wireless access points etc. The measures they can take are e.g. to filter out unwanted RA and DHCP packets, make sure that a system only sends packets with a source address that has been assigned by DHCP (this requires DHCP snooping on the switch) and protections against ARP and ND highjacking.

Such security features are only available on professional equipment, so don't expect them on consumer or SME devices or low-budget enterprise gear.

share|improve this answer

You can log on into the router web interface and setup a static DHCP assigment based on MAC address Follow this procedure for your router model:

1. Go to: System > DHCP > DHCP Servers > DHCPServer1 > Static Hosts > Add > Static Host Entry
2. Now enter:
• Host:192.168.1.1 (enter the host IP address here)
• MAC: 00-01-02-03-04-05 (enter the host MAC address here)
3. Click OK

Now your host every time boot up will receive same IP address. To get your host IP and MAC address on Windows open a cmd windows type ipconfig /all and check the IPv4 Address and Physical address lines for your network interface

share|improve this answer
2  
This doesn't account for manual address entries. DHCP snooping is really what's needed. –  Ryan Foley May 14 at 13:27
1  
Does it prevent a computer to set a duplicate static IP? Like the gateway duplicated IP. –  Patrick Dubois May 14 at 13:34
    
@PatrickDubois No, it doesn't. –  Ryan Foley May 14 at 13:45
2  
The D-Link DFL860 model offer some sort of IP spoofing protection by creating some Access rules. Check section 6.1.2 of the manual dlink.com/-/media/Business_Products/DFL/DFL%20260E/Manual/… –  cioby23 May 14 at 13:49
    
@cioby23, IP spoofing is a different problem than duplicate IP addresses. In the case of the original question, the IP spoofing mentioned in this section of the manual will not help address the problem. –  YLearn May 14 at 20:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.